kyverno Release Notes

What's Changed

• [release-1.19] fix(deps): update x/net for CVE-2026-97032 by @Sashang-debug in #18027
• [release-1.19] fix(deps): update x/net for CVE-2026-78663 by @Sashang-debug in #18025
• fix: repair the post-merge Tests workflow on main (#17761) by @aerosouund in #18035
• test: expect the generation label protection webhook in chainsaw asserts by @aerosouund in #18039
• [release-1.19] fix: preserve legacy generation scope and ownership by @sagark-nirmata in #17937

Full Changelog: v1.19.2-rc1...v1.19.2-rc3

What's Changed
feat: remove kyverno-json from test api by @eddycharly in #16929
feat: remove json scan command by @eddycharly in #16943
fix(policy): preserve validation warnings for generate rules in validateAction by @vishalmore90 in #16821
fix: bump oras.land/oras-go/v2 to v2.6.2 to resolve CVE-2026-50163 by @falloficaruss in #16945
chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.4 to 5.0.6 by @dependabot[bot] in #16933
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.29.1 to 2026.08.03.1 by @dependabot[bot] in #16934
chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #16936
chore(deps): Upgrade robfig/cron to v3 by @chimanjain in #16932
chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in #16935
feat(helm): add configurable lifecycle hooks to all controllers by @mhulscher in #16444
chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in #16937
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.03.1 to 2026.08.03.2 by @dependabot[bot] in #16957
feat: remove chainsaw tests using kyverno-json by @eddycharly in #16963
chore(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @dependabot[bot] in #16958
ci: migrate cherry-pick workflows to GitHub App auth by @realshuting in #16967
ci: drop issues permission from cherry-pick app token request by @realshuting in #16968
fix: handle nil input in CopyMap and add unit tests by @KeerthiKumarR in #16979
chore(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @dependabot[bot] in #16966
fix(validation): reject non-string values in request.operation conditions by @omlahore in #16977
fix: IVPOL required has no effect by @lucchmielowski in #16853
feat: remove reference to kyverno-json from go modules by @eddycharly in #17005
chore(deps): bump fluxcd/flux2/action from 2.9.3 to 2.9.4 by @dependabot[bot] in #17006
chore(deps): bump the otel group across 1 directory with 10 updates by @dependabot[bot] in #17007
chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #17009
chore(deps): bump github.com/sigstore/cosign/v3 from 3.1.2 to 3.1.3 by @dependabot[bot] in #17008
Fix goroutine and ticker leak in metrics initialization by @itsvishalyadav in #17024
Fix ticker leak in policyController background reconciliation loop by @itsvishalyadav in #17027
Fix context leak in TTL controller reconcile loop by @itsvishalyadav in #17032
Fix resource leak in sigstore fetchReferrers loop by @itsvishalyadav in #17039
fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger by @realshuting in #17020
fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result by @realshuting in #17061
fix(webhook): do not offload namespaceObject match conditions to the API server by @realshuting in #17069
chore(deps): bump github.com/google/cel-go from 0.30.0 to 0.31.0 by @dependabot[bot] in #17067
chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.6 to 5.0.7 by @dependabot[bot] in #17065
Fix ignored context in notary registry resolution by @itsvishalyadav in #17078
fix(webhooks): handle nil RequestKind and RequestResource in trace middleware by @AYUSH-P-SINGH in #17087
ci: add configurable code freeze check by @realshuting in #17096
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.03.2 to 2026.08.10.1 by @dependabot[bot] in #17066
fix(jmespath): correct function names in validation errors by @Hiten0305l in #17093
fix(ttl): record deleted objects metric after deletion by @Hiten0305l in #17104
[Bug] Fix missing OpenTelemetry tracing for APICalls without custom CA bundle by @itsvishalyadav in #17116
Fix: CLI apply command fails to match resources containing hyphens by @vishalmore90 in #17124
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.10.1 to 2026.08.10.2 by @dependabot[bot] in #17118
fix: resolve variable shadowing and add unit tests in pkg/utils/conditions by @KeerthiKumarR in #16982
fix(kube): support multi-digit API version strings in ParseKindSelector by @AYUSH-P-SINGH in #16874
bump sdk version by @aerosouund in #17145
fix(webhooks): record MPOL and NMPOL metrics under WebhookMutating by @AYUSH-P-SINGH in #16894
[Bug] Fix CVE-2026-56853 (HTTP/2 ReadHeaderTimeout evasion) by bumping x/net by @itsvishalyadav in #17156
[Bug] Fix CVE-2026-56853 in standard library by bumping Go to 1.26.6 by @itsvishalyadav in #17189
fix(imageverify): repopulate intoto payload on attestation cache hit by @Gagansharma-code in #17117
chore(deps): bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in #17141
chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 by @dependabot[bot] in #17187
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #17196
chore(deps): bump github.com/envoyproxy/go-control-plane/envoy from 1.37.0 to 1.39.0 by @dependabot[bot] in #17198
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.10.2 to 2026.08.14.1 by @dependabot[bot] in #17184
chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @dependabot[bot] in #17185
chore(deps): bump github.com/aptible/supercronic from 0.2.48 to 0.2.49 by @dependabot[bot] in #17197
fix(cli): pass resolved subresource to CEL policy engine requests by @pujitha24 in #17047
Security : fix: patch dependency CVEs (oras-go, x/mod, Go toolchain) by @sagarkhandagre998 in #17160
fix(helm): bump bundled reports-server dependency to v0.1.7 by @pujitha24 in #17138
fix(cli): prevent remote HTTP loaders from hanging indefinitely by @Suhani95 in #16608
fix(test): loosen chainsaw stderr checks to contains by @IceCodeBear in #17235
[Bug] Fix CVE-2026-46600 (DNS parsing panic) by bumping miekg/dns by @itsvishalyadav in #17215
fix(ivpol): reject ImageValidatingPolicy with empty matchConstraints by @AYUSH-P-SINGH in #17162
ci: paginate milestone lookup in assign-milestone workflow by @realshuting in #17240
ci: repair dead path globs in PR auto-labelling config by @Bhuvanesh66 in #17245
feat(cli): support JSON and YAML output for version command by @AYUSH-P-SINGH in #16623
fix(deps): update golang.org/x/net to v0.58.0 by @Sashang-debug in #17242
Fix missing autogen webhook expansion for NamespacedValidatingPolicy by @vishalmore90 in #17262
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #17271
fix: apply HTTP blocklist to apiCall.service executor by @IceCodeBear in #17234
fix(deps): replace rekor to fix GO-2026-5932 by @Sashang-debug in #17269
fix: harden apiCall.service egress proxy path and cover CABundle branch by @realshuting in #17299
chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in #17293
chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 by @dependabot[bot] in #17297
chore(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.8 by @dependabot[bot] in #17295
fix: avoid data race in image evaluator prefetch by @realshuting in #17313
chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in #17294
fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress by @CodexRaunak in #17310
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.14.1 to 2026.08.24.1 by @dependabot[bot] in #17340
Bump kyverno sdk to 68d74afcb07a by @raunak-nirmata in #17348
fix: report all failing images in verifyImages (v1) failure message. by @pyd-07 in #16447
chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in #17360
fix(test): disable IVPol digest defaults in leftover fixtures by @IceCodeBear in #17357
fix(deps): use upstream rekor v1.5.4 instead of the fork replace by @omlahore in #17332
fix: validate PolicyException CEL match conditions by @thuanlm215 in #17350
feat: phase1 deprecation warning plumbing and CLI warning enforcement by @realshuting in #17362
fix(test): disable IVPol digest defaults in leftover report fixtures by @IceCodeBear in #17375
fix(observability): resolve structured logging anti-pattern (fmt.Sprintf) by @Sashang-debug in #17383
feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction by @Rohanraj123 in #17014
test: fix 'occured' typo in response_test.go by @SatyamPandey-07 in #17402
docs: correct spelling and grammar mistakes in documentation by @7se7en72025 in #16274
chore(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.37.9 by @dependabot[bot] in #17417
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #17415
chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 by @dependabot[bot] in #17416
chore(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.0 by @dependabot[bot] in #17414
chore(deps): bump the otel group across 1 directory with 10 updates by @dependabot[bot] in #17413
fix(cli): use policy api version in OCI annotations by @karthikmanam in #16570
fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker by @pujitha24 in #17136
docs: fix development CRD output path by @rajanpanth in #17168
feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 by @realshuting in #17428
fix: handle missing reports CRDs as no-op in kyverno-init by @raunak-nirmata in #17420
fix: skip namespace lookup in exception matching when no namespaceSelector is defined by @kmehta-code in #17140
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.24.1 to 2026.08.31.1 by @dependabot[bot] in #17424
fix: skip scalar values during wildcard image extraction by @ShreyanshK1103 in #16268
Fix/ivpol ephemeral containers by @pmlopes in #17427
fix(gpol): propagate synchronize option to UpdateRequests by @vflaux in #16920
fix(reports): discover autogen'd IVPol/NIVPol targets for background scan by @Rohanraj123 in #17395
fix(webhook): avoid redundant recorder notifications by @Udaytaneja in #17059
fix: deny globalContext in namespaced policies by @IceCodeBear in #17377
fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling by @bhuvan-somisetty in #16904
fix(cel): read PolicyExceptions from the manager cache, not a second informer by @7se7en72025 in #16993
fix: use Docker CE instead of moby for docker-outside-of-docker feature by @tendinginfinity24 in #16596
fix(webhooks): return after writing StatusInternalServerError in Probe handler by @AYUSH-P-SINGH in #17288
chore(deps): bump helm/kind-action from 1.14.0 to 1.15.0 by @dependabot[bot] in #17468
fix(reports): fix label prefix and metadata for namespaced CEL policies by @anushkagupta200615-jpg in #17460
fix(background): use dynamic restmapper and enable crd watcher by @anushkagupta200615-jpg in #17482
fix: close layer readers per-iteration to avoid FD/memory leak by @pgmpofu in #16994
chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #17500
chore(deps): bump fluxcd/flux2/action from 2.9.4 to 2.9.5 by @dependabot[bot] in #17442
chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.12 to 1.2.13 by @dependabot[bot] in #17439
chore(deps): bump sigs.k8s.io/controller-tools from 0.21.0 to 0.22.0 in /hack/controller-gen by @dependabot[bot] in #17467
fix(gpol): recreate downstream resource after repeated deletions by @realshuting in #17453
chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.7 to 5.0.8 by @dependabot[bot] in #17516
chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in #17499
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.08.31.1 to 2026.09.07.1 by @dependabot[bot] in #17514
ci: record failed job instances in workflow failure issues by @Dreamstick9 in #16889
ci: exempt Dependabot from PR rate limit by @JimBugwadia in #17539
feat: block creates and spec-updates of legacy policy APIs (1.20) by @Rohanraj123 in #17535
fix(breaker): recover the reports counter when its watch dies for good by @nissessenap in #17085
ci: run legacy-policy conformance suites in 1.20 migration-grace mode by @raunak-nirmata in #17544
docs: fix 'becuase' typo in enforce-validate-existing test README by @shashankvarma499 in #17550
test: fix 'explicitely' and 'implicitely' typos in roleRef_test.go by @SatyamPandey-07 in #17422
fix(webhook): avoid image validating policy webhook name collisions by @Ahmad-Faraj in #17558
feat: signal remaining legacy kyverno.io policies on startup and via metrics by @raunak-nirmata in #17519
perf(cel): build the request activation once per admission request by @raunak-nirmata in #17572
perf(cel): hoist the request-map build in the ivpol engine by @raunak-nirmata in #17585
feat(helm): add required default-on gate for legacy policy CRs on install and upgrade by @raunak-nirmata in #17534
test(ci): CEL admission-path allocation-regression gate (post-merge) by @raunak-nirmata in #17573
chore: add rx18-eng as a code owner for relevant packages by @rx18-eng in #17590
Update performance thresholds by @raunak-nirmata in #17600
fix: reuse compiled ImageValidatingPolicy CEL programs across admissions by @ANAMASGARD in #17599
fix: preserve legacy report sources and webhook API versions in 1.20 by @raunak-nirmata in #17554
fix(deleting): process namespaced resources with pagination by @ShreyanshK1103 in #17263
fix(cli): use CRD-declared plural when indexing CR instances in fake DClient by @afarbos in #16964
feat(cli): block legacy policy manifests in apply/test, add migration escape hatch by @Rohanraj123 in #17553
fix(cli): resolve match constraints for namespaced validating policies by @harshrajdebug in #17608
fix: autogen fine-grained namespaced image policies by @Elvand-Lie in #16840
chore(deps): bump kyverno sdk version to the latest commit by @guy-avigdor-zota in #17616
Plan + dry-run tooling: rebase legacy-policy PRs to release-1.19 by @JimBugwadia in #17567
fix(policy): resolve subresource triggers in mutating policy matchConstraints by @anushkagupta200615-jpg in #17495
docs: make the repo agent-friendly (AGENTS.md hierarchy, ARCHITECTURE.md, docs/context) by @suhaani-agarwal in #17556
Update runner to use ubuntu-latest for workflows by @NerfedAce in #17623
fix(webhook): enforce exceptionNamespace for CEL PolicyExceptions by @anushkagupta200615-jpg in #17479
test: add upgrade and rollback verification for legacy policy migration by @raunak-nirmata in #17655
chore(deps): bump kyverno/sdk and pass loggers to its registry helpers by @rx18-eng in #17656
feat(helm): protect legacy policy CRDs from Helm prune with resource-policy keep by @thisis-manan in #17494
fix: always re-arm background scan and TTL controllers after transient errors (#16109) by @ANAMASGARD in #16288
feat(kyvernopre): warn about orphaned legacy webhook configurations by @Rohanraj123 in #17678
fix(cel): set rule name for validate.cel results by @yashrajshuklaaa in #17353
feat(cli): enable OCI-native test and apply flows (#17666) by @anushkagupta200615-jpg in #17689
refactor(engine): move context interfaces to engine api package by @JituRewar in #17658
feat(cli): implement CEL resources only for kyverno oci (#17661) by @anushkagupta200615-jpg in #17671
ci: add an E2E gate status that is red while an E2E failure issue is open by @Dreamstick9 in #17650
fix(event): truncate event notes on a character boundary by @Ahmad-Faraj in #17581
fix(cel): requeue namespaced policies on PolicyException changes by @Ahmad-Faraj in #17641
fix: nil pointer dereference in validation engine on UPDATE requests by @AftAb-25 in #17355
fix(cli): close the junit failure element without detailed results by @Ahmad-Faraj in #17560
fix(cli): preserve GeneratingPolicy skips in test results by @Om-Beast in #17388
fix: replace remaining fmt.Sprintf in logr messages with structured fields by @sriramg-aivar in #17627
fix: preserve MutatingPolicy reinvocation policy by @pyd-07 in #17324
feat(charts): support Pod user namespaces in PSS policies by @Suhani95 in #17693
fix(controllers): honor resourceFilters in cleanup and deleting controllers by @anushkagupta200615-jpg in #17632
fix(background): resolve generate triggers by name instead of listing the namespace by @kmehta-code in #17702
Fix panic in metrics policy controller and add comprehensive unit tests by @nishant-devv in #17750
ci: add CodeRabbit/Copilot review config and Dependabot automation by @suhaani-agarwal in #17698
fix: rename startRountine to startRoutine in metrics policy controller by @tendinginfinity24 in #17757
Remove go report from README by @priorax in #17762
docs(cli): document clone source mapping in test aggregation loop by @JituRewar in #17625
feat: add compensating controls to policy exceptions by @mastersans in #17690
ci: fix Dependabot triage CI failures, redesign pr-readiness-check triggers by @suhaani-agarwal in #17766
fix(cli): aggregate test filter errors using errors.Join by @JituRewar in #17760
test: add unit tests for exceptions controller by @JituRewar in #17637
bump go to 1.27 and sigstore to v1.10.10 by @aerosouund in #17776
fix: harden legacy PR triage safety by @JimBugwadia in #17772
fix(cli): flatten kind: List resources in apply and fake dynamic client by @anushkagupta200615-jpg in #17504
fix(mpol): evaluate matchConditions during background mutateExisting evaluation by @pujitha24 in #17433
ci: exclude E2E Gate from remaining CI-health checks by @suhaani-agarwal in #17775
fix(cli): support all CEL policy exception versions in policy loader (#17743) by @anushkagupta200615-jpg in #17769
fix: verify annotations properly for cosign v2 and v3 by @aerosouund in #17794
fix: prevent panic in jmespath random() function on invalid argument type by @Zara-5 in #17773
fix: repair the post-merge Tests workflow on main by @rx18-eng in #17761
chore(deps): bump github.com/sigstore/sigstore from 1.10.10 to 1.11.0 by @dependabot[bot] in #17801
chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.2 by @dependabot[bot] in #17802
chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.09.07.1 to 2026.09.28.1 by @dependabot[bot] in #17803
fix: preserve Cosign errors in image validation messages by @ANAMASGARD in #17606
feat: support additionalExtensions for keyless signing in the ivpol by @aerosouund in #17813
test(cli): cover CRD-aware policy test mapping by @JimBugwadia in #17808
ci: set a PR's milestone from the issue it closes by @suhaani-agarwal in #17812
ci: add workflow-approval-required readiness label by @suhaani-agarwal in #17817
ci: add a manual backfill to the pr-milestone workflow by @suhaani-agarwal in #17819
chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.8 to 5.0.9 by @dependabot[bot] in #17723
chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #17681
chore(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1 by @dependabot[bot] in #17679
chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in #17571
chore(deps): bump the sigstore group across 1 directory with 4 updates by @dependabot[bot] in #17568
fix(chart): add policies.kyverno.io types to the Grafana dashboard by @VijayabaskarR-06 in #17800
fix: mark admission replicas unready after informer watch failures by @ANAMASGARD in #17610
fix(cli): report excluded DeletingPolicy resources as skipped by @pyd-07 in #17458
fix(status): heal WebhookConfigured condition once a VAP is generated by @pujitha24 in #17119
fix: dont treat missing digests when MutateDigest==false as an error by @aerosouund in #17841
fix: evaluate ImageValidatingPolicies concurrently by @pyd-07 in #17496
refactor/cleanup: multiple cleanups across the ivpol code for maintainability by @aerosouund in #17851
ci: refresh Go build cache by run ID by @ShreyanshK1103 in #17732
fix(helm): scope scale-to-zero hook to the release by @KKamJi98 in #17840
test: update vpol conformance asserts for VAP-generated WebhookConfigured message by @Sanchit2662 in #17855
fix(charts): stop denying Windows pods and refresh PSA allow-lists by @Suhani95 in #17684
Vpol wiring for trace feature by @aditip149209 in #17695
ci: add stale-author and idle-review sweep, harden dependabot triage by @suhaani-agarwal in #17864
ci: don't treat the Codecov upload failure as the PR author's to fix by @suhaani-agarwal in #17878
fix(charts): enforce drop ALL and deny pod-level runAsNonRoot=false in PSS CEL policies by @Suhani95 in #17672
ci: make the E2E gate easy to clear by @Dreamstick9 in #17858
ci: start the stale clock at the latest commit or merge conflict by @suhaani-agarwal in #17886
fix(ivpol): give each policy its own image context during concurrent evaluation by @rx18-eng in #17860
fix(ivpol): contain panics in per-policy evaluation goroutines by @rx18-eng in #17894
fix(cli): propagate messageExpression errors to fail cli tests by @nishant-devv in #17863
fix: apply autogen path rewrite to PolicyException matchConditions (#16956) by @nishant-devv in #17856
feat(charts): add disallow-host-probes Baseline PSS policy by @Suhani95 in #17716
ivpol: Add diagnostics to cli for notary verification by @aditip149209 in #17902
fix(cli): restore test checks with CEL expressions by @afarbos in #17897
fix(vpol): keep controller metadata paths in autogen'd PolicyExceptions by @ManojLamani in #17903
ci: remove redundant PR rate limiter workflow by @JimBugwadia in #17928
test: update ivpol conformance asserts for Notary verification details by @harshrajdebug in #17916
test: fix two flaky conformance tests by @rx18-eng in #17934
fix(ivpol): propagate the admission request context to image verification by @rx18-eng in #17895
fix(mutate): escape YAML-forbidden characters in patchStrategicMerge by @thebearmayor in #17881
test(imageverify): pass context to NewRuntimeForPolicy in notary diagnostics test by @pujitha24 in #17947
fix(cli): prevent nil pointer dereference when target has no patched resource by @anushkagupta200615-jpg in #17843
All policy code by @aditip149209 in #17774
fix(deps): bump Go version to 1.27.2 to resolve CVE-2026-97031 (#17959) by @anushkagupta200615-jpg in #17971
fix(ivpol): skip registry fetch when image verification is cached (#17969) by @anushkagupta200615-jpg in #17974
fix(imageverify): bind verification cache entries to the content and attestors they verified by @raunak-nirmata in #17993
ci: add k8s 1.36 to the conformance matrix by @antcybersec in #17781
fix(security): CEL API path validation and mpol namespace confinement by @Rohanraj123 in #17985
chore: add OSS Scanner build files and threat model by @IceCodeBear in #17982
fix: update x/net for CVE-2026-78663 by @Sashang-debug in #17997
fix(security): harden cherry-pick workflows against script injection by @JimBugwadia in #18012
test(ivpol): pin the cache hit test to a digest reference by @VijayabaskarR-06 in #18011
fix: skip cherry-pick comments without authors by @JimBugwadia in #18016
fix(imageverify): bound the reads image verification makes from a registry by @raunak-nirmata in #17995
fix(wildcard): replace the glob matcher with a bounded two-pointer algorithm by @raunak-nirmata in #17990
fix(cel): bound the cost of CEL policy expression evaluation by @raunak-nirmata in #17988
fix(vap): apply the runtime PolicyException gates in the CEL admission-policy generator by @raunak-nirmata in #17986
chore: remove dead AutogenV2 feature flag by @geeknishantkyeus in #18020
feat: implement UpdateRequest cleanup TTL via configuration by @Mannan-Ali in #17429
Dpol wiring by @aditip149209 in #17850
docs: add in-repo design proposal process by @JimBugwadia in #17720
Fix conformance cleanup timeouts by @JimBugwadia in #18029
fix: preserve controller-owned generation labels by @sagark-nirmata in #17938
fix(engine): handle multiple cosign attestation versions by @anushkagupta200615-jpg in #18010
fix: honor wildcard excludeResourceRules in generateExisting by @Siddhartha-singh01 in #18026
fix(cli): use Report kind for namespaced OpenReports output by @Elvand-Lie in #17809
test(profiling): add unit tests for pprof handlers and Start by @JituRewar in #17811
fix(chart): grant the background controller what Kyverno aggregates i… by @WHOIM1205 in #18019
test: keep exclude-images-multiple-cel pods off the node by @Sanchit2662 in #18002
fix(deps): bump golang.org/x/net to resolve CVE-2026-78669 (#17966) by @anushkagupta200615-jpg in #17968
fix(generate): fix GeneratingPolicy synchronization for custom resources and multiple triggers by @rx18-eng in #16748
test: fix conformance expectations after generation-label protection by @JimBugwadia in #18040
fix(metrics): cache GetManager() result in registerPolicyChangesMetric by @tendinginfinity24 in #17862
fix(vpol): honour failurePolicy Ignore for runtime errors in the admission handler by @VijayabaskarR-06 in #17909
test: run generation bootstrap checks in an isolated cluster by @sagark-nirmata in #18028
ci: run all integration packages and the ivpol registry tests by @Sanchit2662 in #17933
fix(imageverify): give the image verify cache a usable byte budget by @rx18-eng in #17911
Wiring for GPOL cel policy types by @aditip149209 in #17867
docs: propose schema-driven CEL processing by @JimBugwadia in #17721
New Contributors
@vishalmore90 made their first contribution in #16821
@falloficaruss made their first contribution in #16945
@mhulscher made their first contribution in #16444
@KeerthiKumarR made their first contribution in #16979
@omlahore made their first contribution in #16977
@AYUSH-P-SINGH made their first contribution in #17087
@Hiten0305l made their first contribution in #17093
@Gagansharma-code made their first contribution in #17117
@pujitha24 made their first contribution in #17047
@Bhuvanesh66 made their first contribution in #17245
@CodexRaunak made their first contribution in #17310
@thuanlm215 made their first contribution in #17350
@SatyamPandey-07 made their first contribution in #17402
@rajanpanth made their first contribution in #17168
@ShreyanshK1103 made their first contribution in #16268
@pmlopes made their first contribution in #17427
@vflaux made their first contribution in #16920
@Udaytaneja made their first contribution in #17059
@anushkagupta200615-jpg made their first contribution in #17460
@pgmpofu made their first contribution in #16994
@Dreamstick9 made their first contribution in #16889
@nissessenap made their first contribution in #17085
@shashankvarma499 made their first contribution in #17550
@Ahmad-Faraj made their first contribution in #17558
@Elvand-Lie made their first contribution in #16840
@guy-avigdor-zota made their first contribution in #17616
@suhaani-agarwal made their first contribution in #17556
@NerfedAce made their first contribution in #17623
@thisis-manan made their first contribution in #17494
@JituRewar made their first contribution in #17658
@Om-Beast made their first contribution in #17388
@sriramg-aivar made their first contribution in #17627
@nishant-devv made their first contribution in #17750
@priorax made their first contribution in #17762
@Zara-5 made their first contribution in #17773
@VijayabaskarR-06 made their first contribution in #17800
@KKamJi98 made their first contribution in #17840
@Sanchit2662 made their first contribution in #17855
@ManojLamani made their first contribution in #17903
@thebearmayor made their first contribution in #17881
@antcybersec made their first contribution in #17781
@geeknishantkyeus made their first contribution in #18020
@Mannan-Ali made their first contribution in #17429
@Siddhartha-singh01 made their first contribution in #18026
Full Changelog: v1.19.2-rc.1...v1.19.2-rc.2

fix(pss): map procMount_restricted for user namespace pods

Map the PSA fork's new procMount_restricted check to the /proc Mount Type control so exclusions, PolicyExceptions and reports keep working, and add unit and CLI tests for hostUsers: false.

Refs #15981

Depends on kyverno/pod-security-admission#6

Signed-off-by: Suhani [email protected]

chore(deps): bump kyverno/pod-security-admission to 40bb0fb

Pick up the Kubernetes 1.35 user namespace checks from kyverno/pod-security-admission#6, and regenerate the CLI test file to match codegen output.

Signed-off-by: Suhani [email protected]

Signed-off-by: Suhani [email protected]

What's Changed

fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by @Manoj-Kumar-Selvaraj in #17230

fix: update Go to address CVE-2026-56853 by @Sashang-debug in #17232

Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #17262) by @kyverno-pr-updater[bot] in #17273

fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #17234) by @realshuting in #17298

fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #17299) by @kyverno-pr-updater[bot] in #17302

fix: avoid data race in image evaluator prefetch (Cherry-pick #17313) by @kyverno-pr-updater[bot] in #17327

cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c) by @realshuting in #17307

fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pick #17310) by @kyverno-pr-updater[bot] in #17329

fix(test): disable mutateDigest in exceptions-disabled IVPol by @IceCodeBear in #17336

fix(test): loosen chainsaw stderr checks to contains by @IceCodeBear in #17334

Bump kyverno sdk to 68d74afcb07a by @raunak-nirmata in #17349

fix(test): disable IVPol digest defaults in leftover fixtures in v1.19 by @IceCodeBear in #17356

fix(deps): bump golang.org/x/mod to v0.40.0 by @IceCodeBear in #17358

fix: backport 7ac176a apiCall urlPath hardening to release-1.19 by @realshuting in #17361

feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick #17362) by @kyverno-pr-updater[bot] in #17378

fix: validate PolicyException CEL match conditions (Cherry-pick #17350) by @kyverno-pr-updater[bot] in #17373

fix(test): disable IVPol digest defaults in leftover report fixtures by @IceCodeBear in #17376

fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick #17136) by @kyverno-pr-updater[bot] in #17430

fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick #17420) by @kyverno-pr-updater[bot] in #17435

feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick #17428) by @kyverno-pr-updater[bot] in #17434

fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick #17140) by @kyverno-pr-updater[bot] in #17437

fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick #16920) by @kyverno-pr-updater[bot] in #17446

fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick #16904) by @kyverno-pr-updater[bot] in #17454

fix(webhook): avoid redundant recorder notifications (Cherry-pick #17059) by @kyverno-pr-updater[bot] in #17451

[release-1.19] fix: deny globalContext in namespaced policies (#17377) by @realshuting in #17455

[release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informer (#16993) by @realshuting in #17464

fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick #17460) by @kyverno-pr-updater[bot] in #17480

fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick #16994) by @kyverno-pr-updater[bot] in #17498

[release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by @realshuting in #17513

fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick #17453) by @kyverno-pr-updater[bot] in #17520

fix: skip scalar values during wildcard image extraction (Cherry-pick #16268) by @kyverno-pr-updater[bot] in #17521

chore: cut release v1.19.1-rc.1 by @realshuting in #17522

feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick #17014) by @Rohanraj123 in #17530

fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick #17395) by @kyverno-pr-updater[bot] in #17447

chore: cut release v1.19.1 by @realshuting in #17541

New Contributors

@Manoj-Kumar-Selvaraj made their first contribution in #17230

Full Changelog: v1.19.0...v1.19.1

What's Changed

• fix: limit intermediate certs to mitigate CVE-2026-32280 by @atharrva01 in #15858
• ci: fix cosign releaser step by @lucchmielowski in #15932
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in #15917
• Feat/cli apply cross resource by @SargamPuram in #15846
• automate stale PR updates by @JimBugwadia in #15942
• fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by @JimBugwadia in #15960
• fix permissions for pr-branch-updater by @JimBugwadia in #15967
• use existing PR updater token by @JimBugwadia in #15974
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #15976
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #15943
• update blocklist to allow in-cluster HTTP calls by @JimBugwadia in #15973
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in #15954
• chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @dependabot[bot] in #15961
• ci: Fix http conformance test blocklist by @lucchmielowski in #15986
• Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by @rx18-eng in #15733
• chore: update available versions in issues by @lucchmielowski in #15996
• test: add dpol controller integration tests by @rx18-eng in #15859
• test: add gpol exception and CEL edge case integration tests by @rx18-eng in #15787
• refactor: drop reliance on EnvSet in favor of in-library versioning by @aerosouund in #16014
• fix(jmespath): prevent panic in label_match on nested structures by @pulkitvats2007-crypto in #15827
• fix: retry on conflict when updating policy status by @williamclot in #15754
• fix: restart dynamic watchers in background reporting on 410 by @aerosouund in #16028
• chore: add framework tests github workflow by @aerosouund in #15743
• fix: support cluster-scoped resource generation in GeneratingPolicy by @realshuting in #16018
• fix: pass AdmissionRequest to updaterequests for mutate existing policy by @realshuting in #16050
• fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @SargamPuram in #15784
• ci: skip framework tests on docs-only and helm-only PRs by @rx18-eng in #16088
• fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @SargamPuram in #16034
• Fix/cli multiple json payloads by @SargamPuram in #15584
• feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @SargamPuram in #15948
• chore: add new gpol samples by @realshuting in #16097
• fix: validate name field in globalReference context entry by @atharrva01 in #16003
• fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @liuxu623 in #16099
• fix: skip report creation for subresources with empty name/UID by @realshuting in #16114
• feat: add updaterequest total gauge metric by @realshuting in #16115
• feat(helm): support extraArgs in CRDs migration job by @Suhani95 in #16132
• feat: add non-goals by @realshuting in #16144
• chore: point to security assessments by @realshuting in #16145
• chore: update dependency policy by @realshuting in #16150
• fix(engine/vpol): include CEL validation expression index in policy report properties by @Rohanraj123 in #15916
• feat(helm): add optional PrometheusRule template by @realshuting in #16155
• chore: clarify performance baselines by @realshuting in #16154
• feat: update api docs by @realshuting in #16143
• feat: add NOTICE and embed attribution in container images by @realshuting in #16151
• feat: add opertional runbook by @realshuting in #16149
• feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @SargamPuram in #16123
• fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @yashrajshuklaaa in #16167
• fix(Makefile): wire readiness-checker into local kind dev workflow by @mastersans in #16181
• test: add NewTestEnvWithOptions for opt-in policy type wiring by @rx18-eng in #16005
• fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by @sandert-k8s in #16055
• docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by @realshuting in #16197
• test: add additional dpol controller integration tests by @rx18-eng in #15966
• ci: cache envtest binaries between framework test runs by @rx18-eng in #16110
• fix(dpol): apply namespaceSelector against Namespace resource own labels by @realshuting in #16200
• fix: do not abort required validation on non-matching images by @lucchmielowski in #16208
• fix(cli): allow multiple CRDs in to be in the --crd-path file by @the-technat in #16161
• test(integration): migrate gpol sync-clone scenarios from chainsaw by @rx18-eng in #16206
• fix: add the readiness checker to the ci image archive by @aerosouund in #16220
• fix: add access to clusterroles and bindings in the standard kyverno config by @aerosouund in #16219
• feat: Enable Cosign verbosity debugging by @naseyro in #16207
• chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by @realshuting in #16241
• ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by @rx18-eng in #16273
• fix: support cel exception in cli apply 'exceptions-within-resources' by @bakito in #16178
• docs: fix duplicated word in cleanuppolicy validateAuth comment by @s3onghyun in #16279
• return correct results for NotEquals type mismatch cases by @7se7en72025 in #16276
• feat(cli): support multiple CRD paths and hook CRD processor into test command by @asiyani in #15824
• fix: wire gpolEngine and gpolProvider into policyController by @yashrajshuklaaa in #16171
• fix: nil pointer panic in getGpolTriggers on ListResource error by @senutpal in #16245
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by @dependabot[bot] in #16045
• Fix UR regression by @avoidik in #16280
• Fix context and SyncWatchers race conditions in GeneratingPolicy by @Aneesh-Hegde in #16041
• feat(pss-helm): add image to allowed volumetypes by @yehlo in #15906
• fix(generate): batch UpdateRequests to avoid etcd size limit by @vmsilvamolina in #15872
• fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @realshuting in #16329
• fix(background): remove dead watcher entry on goroutine exit by @Ebraam-Ashraf in #16130
• fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by @realshuting in #16340
• fix(generate): support NamespacedGeneratingPolicy end-to-end by @realshuting in #16338
• feat: honor expired CEL PolicyExceptions by @realshuting in #16299
• fix(background): scan NamespacedImageValidatingPolicy resources too by @Proximyst in #16301
• fix: validate stdin across apply paths by @karthikmanam in #16347
• feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @SargamPuram in #16297
• fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by @ANAMASGARD in #16291
• chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by @dependabot[bot] in #16371
• fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by @aditip149209 in #16361
• fix(deps): upgrade ristretto to v2 by @chimanjain in #16360
• fix: unblock ko image publish by replacing escaping kodata symlinks by @realshuting in #16381
• chore(workflow): dynamically discover active branches for Trivy issue sync by @realshuting in #16377
• fix CEL autogen namespace replacement by @dag-andersen in #16039
• fix(gpol): support mixed-type aggregate literals in CEL variables by @realshuting in #16339
• docs: fix README workflow badge and AI policy link by @ObaidAbdullah16 in #16162
• fix(deps): bump rekor and in-toto-golang for codeql alerts by @realshuting in #16394
• test: fix webhook registration typo by @ObaidAbdullah16 in #16164
• feat: support skipBackgroundRequests for CEL mpol/gpol by @realshuting in #16369
• test(chainsaw): fix NIVP background + clone-multiple-targets setup by @realshuting in #16399
• chore: update pond dependency to v2 by @chimanjain in #16379
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by @dependabot[bot] in #16402
• Update backoff v7 by @khiemdoan in #16405
• Don't initialize rekor client for key or certificate based scenarios by @aerosouund in #16415
• chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by @dependabot[bot] in #15939
• test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by @realshuting in #16414
• chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by @dependabot[bot] in #15991
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by @dependabot[bot] in #16420
• test(integration): add YAML fixture loaders for the framework by @rx18-eng in #16229
• fix: preserve cluster-scoped generated resources by @Suhani95 in #16362
• fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by @realshuting in #16426
• feat(gpol): support useServerSideApply for GeneratingPolicy by @realshuting in #16403
• fix(api): use allPath instead of anyPath in m.All validation loop by @Utkal059 in #16296
• fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #16256 by @pyd-07 in #16258
• fix(ci): use server-side apply for conformance CRD refresh by @realshuting in #16429
• fix: add sorting for ivpol targets by @1vanden in #16252
• fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @InsomniaCoder in #15865
• fix(ci): force conflicts when server-side applying conformance CRDs by @realshuting in #16432
• fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @sandert-k8s in #16255
• fix(reports): correct label prefix for mpol/dpol policies by @atharrva01 in #16452
• fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @hugolevino in #16298
• fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @ANAMASGARD in #16287
• chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by @dependabot[bot] in #16442
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @dependabot[bot] in #16441
• fix: resolve context leak in dynamic resource watcher by @AftAb-25 in #16087
• feat(gpol): add auditAnnotations support to GeneratingPolicy by @realshuting in #16505
• fix: add policies.kyverno.io resources to aggregate policy roles by @volantebjb in #16239
• fix: address open CodeQL security vulnerabilities by @realshuting in #16528
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #16516
• chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @dependabot[bot] in #16515
• Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @chimanjain in #16511
• fix: skip reports RBAC check when background scanning is disabled by @p-fruck in #16490
• fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @rootp1 in #16544
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by @dependabot[bot] in #16010
• chore(deps): bump the otel group across 1 directory with 4 updates by @dependabot[bot] in #16539
• chore(deps): bump Homebrew/actions/limit-pull-requests from 9ceb7934560eb61d131dde205a6c2d77b2e1529d to 18fcb8e3e06b4247c676c506750dc95ea7226479 by @dependabot[bot] in #16562
• Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by @Suhani95 in #16572
• fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @Karthikk-18 in #16525
• chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by @dependabot[bot] in #16573
• chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @dependabot[bot] in #16575
• fix(chart): wire cleanup controller core extra resources by @Suhani95 in #16165
• fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @rx18-eng in #16561
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by @dependabot[bot] in #16574
• fix: avoid mutating policy webhook name collisions by @realshuting in #16578
• fix: add missing reportProperties to v2beta1 Rule by @zyzzmohit in #15564
• test(integration): single-pass report aggregation helper + flagship test by @rx18-eng in #16244
• ci: add Semgrep SAST workflow by @IceCodeBear in #16464
• fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @AftAb-25 in #16063
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #16576
• fix: key generate test clone sources by policy by @Suhani95 in #16450
• Fix: require --resource for migrate command by @Suhani95 in #16471
• fix(admissionpolicy): default userInfo groups and uid during background scans by @rx18-eng in #16592
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @dependabot[bot] in #16598
• fix: handle whitespace in mpol autogen Object constructor by @santhil-cyber in #16292
• chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @dependabot[bot] in #16599
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @dependabot[bot] in #16600
• fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @pyd-07 in #16588
• fix(mpol): handle DELETE target expression using oldObject by @realshuting in #16610
• fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @rx18-eng in #16611
• fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by @Goutham-Annem in #16630
• fix: add subtests and fix typo in ext/wildcard/match_test.go by @Iqrima in #16625
• fix: resolve error shadowing in SplitDocuments signature by @Iqrima in #16632
• fix: CustomNamespaceLister.List honors the label selector by @7se7en72025 in #16628
• chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by @dependabot[bot] in #16621
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @dependabot[bot] in #16619
• ci: migrate pr-branch-updater to GitHub App auth by @JimBugwadia in #16662
• chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @dependabot[bot] in #16620
• fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @rx18-eng in #16509
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #16669
• chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @dependabot[bot] in #16670
• refactor: add context propagation to background util functions by @farhan11166 in #16643
• cleanup: remove dead fakeContext code by @aerosouund in #16675
• feat: support MutatingPolicy target conditions and subresource targets by @realshuting in #16614
• fix(webhook): scope namespaced policies to their own namespace by @rx18-eng in #16615
• chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by @dependabot[bot] in #16684
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by @dependabot[bot] in #16681
• chore: bump controller-tools by @eddycharly in #16687
• fix: make file extension checks case-insensitive by @Iqrima in #16689
• chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @dependabot[bot] in #16668
• fix(ivpol): add debug logging for CEL image verification functions by @amarkdotdev in #16305
• test: point ivpol cosign tests at the kyverno test-images registry by @rx18-eng in #16695
• feat: reuse image verification cache for ImageValidatingPolicy by @bhuvan-somisetty in #16694
• fix: enforce MutatingPolicy evaluation mode semantics by @realshuting in #16686
• ci: assign release milestone to PRs automatically at release time by @JimBugwadia in #16661
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @dependabot[bot] in #16679
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #16680
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @dependabot[bot] in #16697
• fix: validate MAP-incompatible MutatingPolicy match conditions by @realshuting in #16698
• fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @rx18-eng in #16594
• fix(generate): reject stale trigger UIDs when live resource does not match by @ANAMASGARD in #16603
• Image verification credential handling refactor by @aerosouund in #16439
• fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @JimBugwadia in #16666
• feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @realshuting in #16699
• feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @realshuting in #16703
• fix: strip cross-namespace ownerReferences in CEL-based generation by @realshuting in #16716
• Fix DeletingPolicy objectSelector test results by @Prachidg in #16431
• feat(cel): add regex.replace extension function by @tendinginfinity24 in #16438
• fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @realshuting in #16727
• fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @JimBugwadia in #16663
• fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @rseleven in #16591
• fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @rx18-eng in #16731
• test(integration): add ImageValidatingPolicy support to the framework by @rx18-eng in #16730
• feat(mpol): add auditAnnotations support to MutatingPolicy by @realshuting in #16721
• fix: preserve namespaceSelector during policy autogen by @pyd-07 in #16476
• fix: align policy metrics for new policy formats by @aditip149209 in #16359
• fix: validate DeletingPolicy cron schedule at admission by @Jayashanker-Padishala in #16728
• [Feature] add optional cache bounds via --maxGlobalContextEntries by @IceCodeBear in #16560
• fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by @rx18-eng in #16397
• fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @rx18-eng in #16434
• fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @realshuting in #16739
• fix(helm): use request.namespace for vpolExclude matchConditions by @swastikCommits in #16751
• test(integration): align ivpol framework tests with single-phase image verification by @rx18-eng in #16741
• feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @IceCodeBear in #16749
• chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @dependabot[bot] in #16770
• chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @dependabot[bot] in #16767
• chore(deps): bump the kubernetes group across 3 directories with 7 updates by @dependabot[bot] in #16737
• chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @dependabot[bot] in #16738
• restrict issue self-assignment to good first issues for non-members by @realshuting in #16776
• chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by @dependabot[bot] in #16735
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #16733
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #16734
• fix: resolve namespaceObject with live API fallback on informer cache miss by @realshuting in #16784
• fix(cli): evaluate mutateExisting mutating policies on admission in test by @rx18-eng in #16618
• feat(cli): support admission operation simulation for policy testing by @realshuting in #16787
• fix: honor full-exemption PolicyException when multiple exceptions match by @AftAb-25 in #16060
• fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @Suhani95 in #16249
• fix(engine): honor per-rule failureAction in the admission block deci… by @rx18-eng in #16558
• Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @kubeagon in #15873
• fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @realshuting in #16804
• Fix image verification parity gaps by @JimBugwadia in #16800
• chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @dependabot[bot] in #16802
• fix: IVPOL mutateDigest unimplemented stub by @lucchmielowski in #16815
• chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @dependabot[bot] in #16818
• fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @pyd-07 in #16817
• chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @dependabot[bot] in #16837
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @dependabot[bot] in #16836
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #16834
• fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @realshuting in #16838
• fix: prevent autogen from rewriting namespaceObject in mpol by @lucchmielowski in #15947
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #16835
• fix: bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g by @itsvishalyadav in #16782
• fix: evaluate resource filters from background scanning jobs by @sagarkhandagre998 in #16469
• feat: surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default) by @realshuting in #16868
• feat: remove kyverno-json support from api by @eddycharly in #16792
• fix(dclient): use RESTMapper for GVK to GVR mapping by @FirePheonix in #16905
• Fix context propagation in MatchPolicyContext by @itsvishalyadav in #16910
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in #16913
• [Bug Fix] Fix data race and goroutine leak in policy_spec fuzzing on get bytes error by @itsvishalyadav in #16908
• chore(deps): Upgrade gotest.tools to v3 by @chimanjain in #16915
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12 by @dependabot[bot] in #16914
• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in #16912
• chore: cut release v1.19.0-rc.1 by @realshuting in #16922
• feat: remove kyverno-json from test api (Cherry-pick #16929) by @kyverno-pr-updater[bot] in #16971
• feat: remove chainsaw tests using kyverno-json (Cherry-pick #16963) by @kyverno-pr-updater[bot] in #16972
• feat: remove json scan command (Cherry-pick #16943) by @kyverno-pr-updater[bot] in #16973
• fix: IVPOL required has no effect (Cherry-pick #16853) by @kyverno-pr-updater[bot] in #16987
• fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #16821) by @kyverno-pr-updater[bot] in #17012
• feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #16444) by @kyverno-pr-updater[bot] in #17011
• fix(validation): reject non-string values in request.operation conditions (Cherry-pick #16977) by @kyverno-pr-updater[bot] in #17013
• feat: remove reference to kyverno-json from go modules (cherry-pick #17005) by @realshuting in #17010
• Fix goroutine and ticker leak in metrics initialization (Cherry-pick #17024) by @kyverno-pr-updater[bot] in #17025
• Fix ticker leak in policyController background reconciliation loop (Cherry-pick #17027) by @kyverno-pr-updater[bot] in #17030
• Fix context leak in TTL controller reconcile loop (Cherry-pick #17032) by @kyverno-pr-updater[bot] in #17034
• Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #17039) by @kyverno-pr-updater[bot] in #17042
• fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #17020) by @kyverno-pr-updater[bot] in #17048
• fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #17061) by @kyverno-pr-updater[bot] in #17064
• fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #17069) by @kyverno-pr-updater[bot] in #17072
• chore: cut release v1.19.0-rc.2 by @realshuting in #17073
• Fix ignored context in notary registry resolution (Cherry-pick #17078) by @kyverno-pr-updater[bot] in #17079
• fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #17087) by @kyverno-pr-updater[bot] in #17091
• ci: add configurable code freeze check by @realshuting in #17095
• chore: cut release v1.19.0-rc.3 by @realshuting in #17094
• fix(imageverify): repopulate intoto payload on attestation cache hit (#17117) by @realshuting in #17195
• Release 1.19.0-rc.4 by @realshuting in #17209
• chore: cut release v1.19.0 by @realshuting in #17238

New Contributors

• @pulkitvats2007-crypto made their first contribution in #15827
• @williamclot made their first contribution in #15754
• @mastersans made their first contribution in #16181
• @the-technat made their first contribution in #16161
• @naseyro made their first contribution in #16207
• @s3onghyun made their first contribution in #16279
• @7se7en72025 made their first contribution in #16276
• @asiyani made their first contribution in #15824
• @senutpal made their first contribution in #16245
• @avoidik made their first contribution in #16280
• @Aneesh-Hegde made their first contribution in #16041
• @vmsilvamolina made their first contribution in #15872
• @Ebraam-Ashraf made their first contribution in #16130
• @Proximyst made their first contribution in #16301
• @dag-andersen made their first contribution in #16039
• @ObaidAbdullah16 made their first contribution in #16162
• @khiemdoan made their first contribution in #16405
• @Utkal059 made their first contribution in #16296
• @pyd-07 made their first contribution in #16258
• @1vanden made their first contribution in #16252
• @InsomniaCoder made their first contribution in #15865
• @hugolevino made their first contribution in #16298
• @AftAb-25 made their first contribution in #16087
• @volantebjb made their first contribution in #16239
• @p-fruck made their first contribution in #16490
• @rootp1 made their first contribution in #16544
• @Karthikk-18 made their first contribution in #16525
• @santhil-cyber made their first contribution in #16292
• @Goutham-Annem made their first contribution in #16630
• @Iqrima made their first contribution in #16625
• @farhan11166 made their first contribution in #16643
• @amarkdotdev made their first contribution in #16305
• @bhuvan-somisetty made their first contribution in #16694
• @Prachidg made their first contribution in #16431
• @tendinginfinity24 made their first contribution in #16438
• @rseleven made their first contribution in #16591
• @Jayashanker-Padishala made their first contribution in #16728
• @swastikCommits made their first contribution in #16751
• @kubeagon made their first contribution in #15873
• @FirePheonix made their first contribution in #16905
• @kyverno-pr-updater[bot] made their first contribution in #16971

Full Changelog: v1.18.2...v1.19.0

What's Changed

• fix: restart dynamic watchers in background reporting on 410 (Cherry-pick #16028) by @kyverno-bot in #16030
• fix: do not abort required validation on non-matching images (Cherry-pick #16208) by @kyverno-bot in #16218
• fix(cli): allow multiple CRDs in to be in the --crd-path file (Cherry-pick #16161) by @kyverno-bot in #16215
• fix(gpol,mpol): enforce namespace boundary in generator.apply() (backport GHSA-79gf-7frw-68m9 to release-1.18) by @realshuting in #16238
• feat(pss-helm): add image to allowed volumetypes (Cherry-pick #15906) by @kyverno-bot in #16332
• backport(release-1.18): security dependency bumps from #16340 by @realshuting in #16343
• fix(release-1.18): roll up codeql dependency and toolchain updates by @realshuting in #16395
• fix(reports): correct label prefix for mpol/dpol policies (Cherry-pick #16452) by @kyverno-bot in #16453
• chore: cut v1.18.2-rc.2 by @realshuting in #16517
• chore: cut v1.18.2 by @realshuting in #16526

Full Changelog: v1.18.1...v1.18.2