volker.raschek/kyverno-cli-bin-pkg
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(deps): update dependency kyverno/kyverno to v1.19.0 #5

Open
CSRBot wants to merge 1 commits from renovate/kyverno-kyverno-1.x into master
pull from: renovate/kyverno-kyverno-1.x
merge into: :master
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-08-20 11:09:17 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
kyverno/kyverno minor 1.18.2 → 1.19.0

Release Notes

kyverno/kyverno (kyverno/kyverno)

v1.19.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.18.2...v1.19.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kyverno/kyverno](https://github.com/kyverno/kyverno) | minor | `1.18.2` → `1.19.0` | --- ### Release Notes <details> <summary>kyverno/kyverno (kyverno/kyverno)</summary> ### [`v1.19.0`](https://github.com/kyverno/kyverno/releases/tag/v1.19.0) [Compare Source](https://github.com/kyverno/kyverno/compare/v1.18.2...v1.19.0-rc.2) #### What's Changed - fix: limit intermediate certs to mitigate CVE-2026-32280 by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;15858](https://github.com/kyverno/kyverno/pull/15858) - ci: fix cosign releaser step by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15932](https://github.com/kyverno/kyverno/pull/15932) - chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15917](https://github.com/kyverno/kyverno/pull/15917) - Feat/cli apply cross resource by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15846](https://github.com/kyverno/kyverno/pull/15846) - automate stale PR updates by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15942](https://github.com/kyverno/kyverno/pull/15942) - fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15960](https://github.com/kyverno/kyverno/pull/15960) - fix permissions for pr-branch-updater by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15967](https://github.com/kyverno/kyverno/pull/15967) - use existing PR updater token by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15974](https://github.com/kyverno/kyverno/pull/15974) - chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15976](https://github.com/kyverno/kyverno/pull/15976) - chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15943](https://github.com/kyverno/kyverno/pull/15943) - update blocklist to allow in-cluster HTTP calls by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15973](https://github.com/kyverno/kyverno/pull/15973) - chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15954](https://github.com/kyverno/kyverno/pull/15954) - chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15961](https://github.com/kyverno/kyverno/pull/15961) - ci: Fix http conformance test blocklist by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15986](https://github.com/kyverno/kyverno/pull/15986) - Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15733](https://github.com/kyverno/kyverno/pull/15733) - chore: update available versions in issues by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15996](https://github.com/kyverno/kyverno/pull/15996) - test: add dpol controller integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15859](https://github.com/kyverno/kyverno/pull/15859) - test: add gpol exception and CEL edge case integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15787](https://github.com/kyverno/kyverno/pull/15787) - refactor: drop reliance on EnvSet in favor of in-library versioning by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16014](https://github.com/kyverno/kyverno/pull/16014) - fix(jmespath): prevent panic in label\_match on nested structures by [@&#8203;pulkitvats2007-crypto](https://github.com/pulkitvats2007-crypto) in [#&#8203;15827](https://github.com/kyverno/kyverno/pull/15827) - fix: retry on conflict when updating policy status by [@&#8203;williamclot](https://github.com/williamclot) in [#&#8203;15754](https://github.com/kyverno/kyverno/pull/15754) - fix: restart dynamic watchers in background reporting on 410 by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16028](https://github.com/kyverno/kyverno/pull/16028) - chore: add framework tests github workflow by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;15743](https://github.com/kyverno/kyverno/pull/15743) - fix: support cluster-scoped resource generation in GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16018](https://github.com/kyverno/kyverno/pull/16018) - fix: pass AdmissionRequest to updaterequests for mutate existing policy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16050](https://github.com/kyverno/kyverno/pull/16050) - fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15784](https://github.com/kyverno/kyverno/pull/15784) - ci: skip framework tests on docs-only and helm-only PRs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16088](https://github.com/kyverno/kyverno/pull/16088) - fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16034](https://github.com/kyverno/kyverno/pull/16034) - Fix/cli multiple json payloads by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15584](https://github.com/kyverno/kyverno/pull/15584) - feat(cli): add offline mock support for http mock request/response for GET method and global context entries by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15948](https://github.com/kyverno/kyverno/pull/15948) - chore: add new gpol samples by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16097](https://github.com/kyverno/kyverno/pull/16097) - fix: validate name field in globalReference context entry by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;16003](https://github.com/kyverno/kyverno/pull/16003) - fix(gctx): correctly track per-loader load state to avoid skipping LoadData by [@&#8203;liuxu623](https://github.com/liuxu623) in [#&#8203;16099](https://github.com/kyverno/kyverno/pull/16099) - fix: skip report creation for subresources with empty name/UID by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16114](https://github.com/kyverno/kyverno/pull/16114) - feat: add updaterequest total gauge metric by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16115](https://github.com/kyverno/kyverno/pull/16115) - feat(helm): support extraArgs in CRDs migration job by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16132](https://github.com/kyverno/kyverno/pull/16132) - feat: add non-goals by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16144](https://github.com/kyverno/kyverno/pull/16144) - chore: point to security assessments by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16145](https://github.com/kyverno/kyverno/pull/16145) - chore: update dependency policy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16150](https://github.com/kyverno/kyverno/pull/16150) - fix(engine/vpol): include CEL validation expression index in policy report properties by [@&#8203;Rohanraj123](https://github.com/Rohanraj123) in [#&#8203;15916](https://github.com/kyverno/kyverno/pull/15916) - feat(helm): add optional PrometheusRule template by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16155](https://github.com/kyverno/kyverno/pull/16155) - chore: clarify performance baselines by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16154](https://github.com/kyverno/kyverno/pull/16154) - feat: update api docs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16143](https://github.com/kyverno/kyverno/pull/16143) - feat: add NOTICE and embed attribution in container images by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16151](https://github.com/kyverno/kyverno/pull/16151) - feat: add opertional runbook by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16149](https://github.com/kyverno/kyverno/pull/16149) - feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16123](https://github.com/kyverno/kyverno/pull/16123) - fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by [@&#8203;yashrajshuklaaa](https://github.com/yashrajshuklaaa) in [#&#8203;16167](https://github.com/kyverno/kyverno/pull/16167) - fix(Makefile): wire readiness-checker into local kind dev workflow by [@&#8203;mastersans](https://github.com/mastersans) in [#&#8203;16181](https://github.com/kyverno/kyverno/pull/16181) - test: add NewTestEnvWithOptions for opt-in policy type wiring by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16005](https://github.com/kyverno/kyverno/pull/16005) - fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by [@&#8203;sandert-k8s](https://github.com/sandert-k8s) in [#&#8203;16055](https://github.com/kyverno/kyverno/pull/16055) - docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16197](https://github.com/kyverno/kyverno/pull/16197) - test: add additional dpol controller integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15966](https://github.com/kyverno/kyverno/pull/15966) - ci: cache envtest binaries between framework test runs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16110](https://github.com/kyverno/kyverno/pull/16110) - fix(dpol): apply namespaceSelector against Namespace resource own labels by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16200](https://github.com/kyverno/kyverno/pull/16200) - fix: do not abort required validation on non-matching images by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;16208](https://github.com/kyverno/kyverno/pull/16208) - fix(cli): allow multiple CRDs in to be in the --crd-path file by [@&#8203;the-technat](https://github.com/the-technat) in [#&#8203;16161](https://github.com/kyverno/kyverno/pull/16161) - test(integration): migrate gpol sync-clone scenarios from chainsaw by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16206](https://github.com/kyverno/kyverno/pull/16206) - fix: add the readiness checker to the ci image archive by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16220](https://github.com/kyverno/kyverno/pull/16220) - fix: add access to clusterroles and bindings in the standard kyverno config by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16219](https://github.com/kyverno/kyverno/pull/16219) - feat: Enable Cosign verbosity debugging by [@&#8203;naseyro](https://github.com/naseyro) in [#&#8203;16207](https://github.com/kyverno/kyverno/pull/16207) - chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16241](https://github.com/kyverno/kyverno/pull/16241) - ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16273](https://github.com/kyverno/kyverno/pull/16273) - fix: support cel exception in cli apply 'exceptions-within-resources' by [@&#8203;bakito](https://github.com/bakito) in [#&#8203;16178](https://github.com/kyverno/kyverno/pull/16178) - docs: fix duplicated word in cleanuppolicy validateAuth comment by [@&#8203;s3onghyun](https://github.com/s3onghyun) in [#&#8203;16279](https://github.com/kyverno/kyverno/pull/16279) - return correct results for NotEquals type mismatch cases by [@&#8203;7se7en72025](https://github.com/7se7en72025) in [#&#8203;16276](https://github.com/kyverno/kyverno/pull/16276) - feat(cli): support multiple CRD paths and hook CRD processor into test command by [@&#8203;asiyani](https://github.com/asiyani) in [#&#8203;15824](https://github.com/kyverno/kyverno/pull/15824) - fix: wire gpolEngine and gpolProvider into policyController by [@&#8203;yashrajshuklaaa](https://github.com/yashrajshuklaaa) in [#&#8203;16171](https://github.com/kyverno/kyverno/pull/16171) - fix: nil pointer panic in getGpolTriggers on ListResource error by [@&#8203;senutpal](https://github.com/senutpal) in [#&#8203;16245](https://github.com/kyverno/kyverno/pull/16245) - chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16045](https://github.com/kyverno/kyverno/pull/16045) - Fix UR regression by [@&#8203;avoidik](https://github.com/avoidik) in [#&#8203;16280](https://github.com/kyverno/kyverno/pull/16280) - Fix context and SyncWatchers race conditions in GeneratingPolicy by [@&#8203;Aneesh-Hegde](https://github.com/Aneesh-Hegde) in [#&#8203;16041](https://github.com/kyverno/kyverno/pull/16041) - feat(pss-helm): add image to allowed volumetypes by [@&#8203;yehlo](https://github.com/yehlo) in [#&#8203;15906](https://github.com/kyverno/kyverno/pull/15906) - fix(generate): batch UpdateRequests to avoid etcd size limit by [@&#8203;vmsilvamolina](https://github.com/vmsilvamolina) in [#&#8203;15872](https://github.com/kyverno/kyverno/pull/15872) - fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16329](https://github.com/kyverno/kyverno/pull/16329) - fix(background): remove dead watcher entry on goroutine exit by [@&#8203;Ebraam-Ashraf](https://github.com/Ebraam-Ashraf) in [#&#8203;16130](https://github.com/kyverno/kyverno/pull/16130) - fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16340](https://github.com/kyverno/kyverno/pull/16340) - fix(generate): support NamespacedGeneratingPolicy end-to-end by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16338](https://github.com/kyverno/kyverno/pull/16338) - feat: honor expired CEL PolicyExceptions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16299](https://github.com/kyverno/kyverno/pull/16299) - fix(background): scan NamespacedImageValidatingPolicy resources too by [@&#8203;Proximyst](https://github.com/Proximyst) in [#&#8203;16301](https://github.com/kyverno/kyverno/pull/16301) - fix: validate stdin across apply paths by [@&#8203;karthikmanam](https://github.com/karthikmanam) in [#&#8203;16347](https://github.com/kyverno/kyverno/pull/16347) - feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16297](https://github.com/kyverno/kyverno/pull/16297) - fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16291](https://github.com/kyverno/kyverno/pull/16291) - chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16371](https://github.com/kyverno/kyverno/pull/16371) - fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by [@&#8203;aditip149209](https://github.com/aditip149209) in [#&#8203;16361](https://github.com/kyverno/kyverno/pull/16361) - fix(deps): upgrade ristretto to v2 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16360](https://github.com/kyverno/kyverno/pull/16360) - fix: unblock ko image publish by replacing escaping kodata symlinks by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16381](https://github.com/kyverno/kyverno/pull/16381) - chore(workflow): dynamically discover active branches for Trivy issue sync by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16377](https://github.com/kyverno/kyverno/pull/16377) - fix CEL autogen namespace replacement by [@&#8203;dag-andersen](https://github.com/dag-andersen) in [#&#8203;16039](https://github.com/kyverno/kyverno/pull/16039) - fix(gpol): support mixed-type aggregate literals in CEL variables by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16339](https://github.com/kyverno/kyverno/pull/16339) - docs: fix README workflow badge and AI policy link by [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) in [#&#8203;16162](https://github.com/kyverno/kyverno/pull/16162) - fix(deps): bump rekor and in-toto-golang for codeql alerts by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16394](https://github.com/kyverno/kyverno/pull/16394) - test: fix webhook registration typo by [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) in [#&#8203;16164](https://github.com/kyverno/kyverno/pull/16164) - feat: support skipBackgroundRequests for CEL mpol/gpol by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16369](https://github.com/kyverno/kyverno/pull/16369) - test(chainsaw): fix NIVP background + clone-multiple-targets setup by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16399](https://github.com/kyverno/kyverno/pull/16399) - chore: update pond dependency to v2 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16379](https://github.com/kyverno/kyverno/pull/16379) - chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16402](https://github.com/kyverno/kyverno/pull/16402) - Update backoff v7 by [@&#8203;khiemdoan](https://github.com/khiemdoan) in [#&#8203;16405](https://github.com/kyverno/kyverno/pull/16405) - Don't initialize rekor client for key or certificate based scenarios by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16415](https://github.com/kyverno/kyverno/pull/16415) - chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15939](https://github.com/kyverno/kyverno/pull/15939) - test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16414](https://github.com/kyverno/kyverno/pull/16414) - chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15991](https://github.com/kyverno/kyverno/pull/15991) - chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16420](https://github.com/kyverno/kyverno/pull/16420) - test(integration): add YAML fixture loaders for the framework by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16229](https://github.com/kyverno/kyverno/pull/16229) - fix: preserve cluster-scoped generated resources by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16362](https://github.com/kyverno/kyverno/pull/16362) - fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16426](https://github.com/kyverno/kyverno/pull/16426) - feat(gpol): support useServerSideApply for GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16403](https://github.com/kyverno/kyverno/pull/16403) - fix(api): use allPath instead of anyPath in m.All validation loop by [@&#8203;Utkal059](https://github.com/Utkal059) in [#&#8203;16296](https://github.com/kyverno/kyverno/pull/16296) - fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes [#&#8203;16256](https://github.com/kyverno/kyverno/issues/16256) by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16258](https://github.com/kyverno/kyverno/pull/16258) - fix(ci): use server-side apply for conformance CRD refresh by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16429](https://github.com/kyverno/kyverno/pull/16429) - fix: add sorting for ivpol targets by [@&#8203;1vanden](https://github.com/1vanden) in [#&#8203;16252](https://github.com/kyverno/kyverno/pull/16252) - fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by [@&#8203;InsomniaCoder](https://github.com/InsomniaCoder) in [#&#8203;15865](https://github.com/kyverno/kyverno/pull/15865) - fix(ci): force conflicts when server-side applying conformance CRDs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16432](https://github.com/kyverno/kyverno/pull/16432) - fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by [@&#8203;sandert-k8s](https://github.com/sandert-k8s) in [#&#8203;16255](https://github.com/kyverno/kyverno/pull/16255) - fix(reports): correct label prefix for mpol/dpol policies by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;16452](https://github.com/kyverno/kyverno/pull/16452) - fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by [@&#8203;hugolevino](https://github.com/hugolevino) in [#&#8203;16298](https://github.com/kyverno/kyverno/pull/16298) - fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16287](https://github.com/kyverno/kyverno/pull/16287) - chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16442](https://github.com/kyverno/kyverno/pull/16442) - chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16441](https://github.com/kyverno/kyverno/pull/16441) - fix: resolve context leak in dynamic resource watcher by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16087](https://github.com/kyverno/kyverno/pull/16087) - feat(gpol): add auditAnnotations support to GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16505](https://github.com/kyverno/kyverno/pull/16505) - fix: add policies.kyverno.io resources to aggregate policy roles by [@&#8203;volantebjb](https://github.com/volantebjb) in [#&#8203;16239](https://github.com/kyverno/kyverno/pull/16239) - fix: address open CodeQL security vulnerabilities by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16528](https://github.com/kyverno/kyverno/pull/16528) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16516](https://github.com/kyverno/kyverno/pull/16516) - chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16515](https://github.com/kyverno/kyverno/pull/16515) - Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16511](https://github.com/kyverno/kyverno/pull/16511) - fix: skip reports RBAC check when background scanning is disabled by [@&#8203;p-fruck](https://github.com/p-fruck) in [#&#8203;16490](https://github.com/kyverno/kyverno/pull/16490) - fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by [@&#8203;rootp1](https://github.com/rootp1) in [#&#8203;16544](https://github.com/kyverno/kyverno/pull/16544) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16010](https://github.com/kyverno/kyverno/pull/16010) - chore(deps): bump the otel group across 1 directory with 4 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16539](https://github.com/kyverno/kyverno/pull/16539) - chore(deps): bump Homebrew/actions/limit-pull-requests from [`9ceb793`](https://github.com/kyverno/kyverno/commit/9ceb7934560eb61d131dde205a6c2d77b2e1529d) to [`18fcb8e`](https://github.com/kyverno/kyverno/commit/18fcb8e3e06b4247c676c506750dc95ea7226479) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16562](https://github.com/kyverno/kyverno/pull/16562) - Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16572](https://github.com/kyverno/kyverno/pull/16572) - fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by [@&#8203;Karthikk-18](https://github.com/Karthikk-18) in [#&#8203;16525](https://github.com/kyverno/kyverno/pull/16525) - chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16573](https://github.com/kyverno/kyverno/pull/16573) - chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16575](https://github.com/kyverno/kyverno/pull/16575) - fix(chart): wire cleanup controller core extra resources by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16165](https://github.com/kyverno/kyverno/pull/16165) - fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16561](https://github.com/kyverno/kyverno/pull/16561) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16574](https://github.com/kyverno/kyverno/pull/16574) - fix: avoid mutating policy webhook name collisions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16578](https://github.com/kyverno/kyverno/pull/16578) - fix: add missing reportProperties to v2beta1 Rule by [@&#8203;zyzzmohit](https://github.com/zyzzmohit) in [#&#8203;15564](https://github.com/kyverno/kyverno/pull/15564) - test(integration): single-pass report aggregation helper + flagship test by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16244](https://github.com/kyverno/kyverno/pull/16244) - ci: add Semgrep SAST workflow by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16464](https://github.com/kyverno/kyverno/pull/16464) - fix(helm): handle null image tags in \_image.tpl and fix reports-server defaultTag by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16063](https://github.com/kyverno/kyverno/pull/16063) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16576](https://github.com/kyverno/kyverno/pull/16576) - fix: key generate test clone sources by policy by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16450](https://github.com/kyverno/kyverno/pull/16450) - Fix: require --resource for migrate command by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16471](https://github.com/kyverno/kyverno/pull/16471) - fix(admissionpolicy): default userInfo groups and uid during background scans by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16592](https://github.com/kyverno/kyverno/pull/16592) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16598](https://github.com/kyverno/kyverno/pull/16598) - fix: handle whitespace in mpol autogen Object constructor by [@&#8203;santhil-cyber](https://github.com/santhil-cyber) in [#&#8203;16292](https://github.com/kyverno/kyverno/pull/16292) - chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16599](https://github.com/kyverno/kyverno/pull/16599) - chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16600](https://github.com/kyverno/kyverno/pull/16600) - fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16588](https://github.com/kyverno/kyverno/pull/16588) - fix(mpol): handle DELETE target expression using oldObject by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16610](https://github.com/kyverno/kyverno/pull/16610) - fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16611](https://github.com/kyverno/kyverno/pull/16611) - fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by [@&#8203;Goutham-Annem](https://github.com/Goutham-Annem) in [#&#8203;16630](https://github.com/kyverno/kyverno/pull/16630) - fix: add subtests and fix typo in ext/wildcard/match\_test.go by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16625](https://github.com/kyverno/kyverno/pull/16625) - fix: resolve error shadowing in SplitDocuments signature by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16632](https://github.com/kyverno/kyverno/pull/16632) - fix: CustomNamespaceLister.List honors the label selector by [@&#8203;7se7en72025](https://github.com/7se7en72025) in [#&#8203;16628](https://github.com/kyverno/kyverno/pull/16628) - chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16621](https://github.com/kyverno/kyverno/pull/16621) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16619](https://github.com/kyverno/kyverno/pull/16619) - ci: migrate pr-branch-updater to GitHub App auth by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16662](https://github.com/kyverno/kyverno/pull/16662) - chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16620](https://github.com/kyverno/kyverno/pull/16620) - fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16509](https://github.com/kyverno/kyverno/pull/16509) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16669](https://github.com/kyverno/kyverno/pull/16669) - chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16670](https://github.com/kyverno/kyverno/pull/16670) - refactor: add context propagation to background util functions by [@&#8203;farhan11166](https://github.com/farhan11166) in [#&#8203;16643](https://github.com/kyverno/kyverno/pull/16643) - cleanup: remove dead fakeContext code by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16675](https://github.com/kyverno/kyverno/pull/16675) - feat: support MutatingPolicy target conditions and subresource targets by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16614](https://github.com/kyverno/kyverno/pull/16614) - fix(webhook): scope namespaced policies to their own namespace by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16615](https://github.com/kyverno/kyverno/pull/16615) - chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16684](https://github.com/kyverno/kyverno/pull/16684) - chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16681](https://github.com/kyverno/kyverno/pull/16681) - chore: bump controller-tools by [@&#8203;eddycharly](https://github.com/eddycharly) in [#&#8203;16687](https://github.com/kyverno/kyverno/pull/16687) - fix: make file extension checks case-insensitive by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16689](https://github.com/kyverno/kyverno/pull/16689) - chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16668](https://github.com/kyverno/kyverno/pull/16668) - fix(ivpol): add debug logging for CEL image verification functions by [@&#8203;amarkdotdev](https://github.com/amarkdotdev) in [#&#8203;16305](https://github.com/kyverno/kyverno/pull/16305) - test: point ivpol cosign tests at the kyverno test-images registry by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16695](https://github.com/kyverno/kyverno/pull/16695) - feat: reuse image verification cache for ImageValidatingPolicy by [@&#8203;bhuvan-somisetty](https://github.com/bhuvan-somisetty) in [#&#8203;16694](https://github.com/kyverno/kyverno/pull/16694) - fix: enforce MutatingPolicy evaluation mode semantics by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16686](https://github.com/kyverno/kyverno/pull/16686) - ci: assign release milestone to PRs automatically at release time by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16661](https://github.com/kyverno/kyverno/pull/16661) - chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16679](https://github.com/kyverno/kyverno/pull/16679) - chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16680](https://github.com/kyverno/kyverno/pull/16680) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16697](https://github.com/kyverno/kyverno/pull/16697) - fix: validate MAP-incompatible MutatingPolicy match conditions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16698](https://github.com/kyverno/kyverno/pull/16698) - fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16594](https://github.com/kyverno/kyverno/pull/16594) - fix(generate): reject stale trigger UIDs when live resource does not match by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16603](https://github.com/kyverno/kyverno/pull/16603) - Image verification credential handling refactor by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16439](https://github.com/kyverno/kyverno/pull/16439) - fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16666](https://github.com/kyverno/kyverno/pull/16666) - feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16699](https://github.com/kyverno/kyverno/pull/16699) - feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16703](https://github.com/kyverno/kyverno/pull/16703) - fix: strip cross-namespace ownerReferences in CEL-based generation by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16716](https://github.com/kyverno/kyverno/pull/16716) - Fix DeletingPolicy objectSelector test results by [@&#8203;Prachidg](https://github.com/Prachidg) in [#&#8203;16431](https://github.com/kyverno/kyverno/pull/16431) - feat(cel): add regex.replace extension function by [@&#8203;tendinginfinity24](https://github.com/tendinginfinity24) in [#&#8203;16438](https://github.com/kyverno/kyverno/pull/16438) - fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16727](https://github.com/kyverno/kyverno/pull/16727) - fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16663](https://github.com/kyverno/kyverno/pull/16663) - fix(verification): use sigstore-go TUF client and fallback to trusted\_root.json by [@&#8203;rseleven](https://github.com/rseleven) in [#&#8203;16591](https://github.com/kyverno/kyverno/pull/16591) - fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16731](https://github.com/kyverno/kyverno/pull/16731) - test(integration): add ImageValidatingPolicy support to the framework by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16730](https://github.com/kyverno/kyverno/pull/16730) - feat(mpol): add auditAnnotations support to MutatingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16721](https://github.com/kyverno/kyverno/pull/16721) - fix: preserve namespaceSelector during policy autogen by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16476](https://github.com/kyverno/kyverno/pull/16476) - fix: align policy metrics for new policy formats by [@&#8203;aditip149209](https://github.com/aditip149209) in [#&#8203;16359](https://github.com/kyverno/kyverno/pull/16359) - fix: validate DeletingPolicy cron schedule at admission by [@&#8203;Jayashanker-Padishala](https://github.com/Jayashanker-Padishala) in [#&#8203;16728](https://github.com/kyverno/kyverno/pull/16728) - \[Feature] add optional cache bounds via --maxGlobalContextEntries by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16560](https://github.com/kyverno/kyverno/pull/16560) - fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16397](https://github.com/kyverno/kyverno/pull/16397) - fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16434](https://github.com/kyverno/kyverno/pull/16434) - fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16739](https://github.com/kyverno/kyverno/pull/16739) - fix(helm): use request.namespace for vpolExclude matchConditions by [@&#8203;swastikCommits](https://github.com/swastikCommits) in [#&#8203;16751](https://github.com/kyverno/kyverno/pull/16751) - test(integration): align ivpol framework tests with single-phase image verification by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16741](https://github.com/kyverno/kyverno/pull/16741) - feat(helm): expose maxGlobalContextEntries in the Kyverno chart by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16749](https://github.com/kyverno/kyverno/pull/16749) - chore(deps): bump github.com/prometheus/client\_golang from 1.23.2 to 1.24.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16770](https://github.com/kyverno/kyverno/pull/16770) - chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16767](https://github.com/kyverno/kyverno/pull/16767) - chore(deps): bump the kubernetes group across 3 directories with 7 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16737](https://github.com/kyverno/kyverno/pull/16737) - chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16738](https://github.com/kyverno/kyverno/pull/16738) - restrict issue self-assignment to good first issues for non-members by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16776](https://github.com/kyverno/kyverno/pull/16776) - chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16735](https://github.com/kyverno/kyverno/pull/16735) - chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16733](https://github.com/kyverno/kyverno/pull/16733) - chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16734](https://github.com/kyverno/kyverno/pull/16734) - fix: resolve namespaceObject with live API fallback on informer cache miss by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16784](https://github.com/kyverno/kyverno/pull/16784) - fix(cli): evaluate mutateExisting mutating policies on admission in test by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16618](https://github.com/kyverno/kyverno/pull/16618) - feat(cli): support admission operation simulation for policy testing by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16787](https://github.com/kyverno/kyverno/pull/16787) - fix: honor full-exemption PolicyException when multiple exceptions match by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16060](https://github.com/kyverno/kyverno/pull/16060) - fix: allow pod-level seccomp in restrict-seccomp-strict vpol by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16249](https://github.com/kyverno/kyverno/pull/16249) - fix(engine): honor per-rule failureAction in the admission block deci… by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16558](https://github.com/kyverno/kyverno/pull/16558) - Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by [@&#8203;kubeagon](https://github.com/kubeagon) in [#&#8203;15873](https://github.com/kyverno/kyverno/pull/15873) - fix(helm): disable in-process cert controller when cert-manager delegation is enabled by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16804](https://github.com/kyverno/kyverno/pull/16804) - Fix image verification parity gaps by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16800](https://github.com/kyverno/kyverno/pull/16800) - chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16802](https://github.com/kyverno/kyverno/pull/16802) - fix: IVPOL mutateDigest unimplemented stub by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;16815](https://github.com/kyverno/kyverno/pull/16815) - chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16818](https://github.com/kyverno/kyverno/pull/16818) - fix: enforce verifyDigest in ImageValidatingPolicy evaluator by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16817](https://github.com/kyverno/kyverno/pull/16817) - chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16837](https://github.com/kyverno/kyverno/pull/16837) - chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16836](https://github.com/kyverno/kyverno/pull/16836) - chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16834](https://github.com/kyverno/kyverno/pull/16834) - fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16838](https://github.com/kyverno/kyverno/pull/16838) - fix: prevent autogen from rewriting namespaceObject in mpol by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15947](https://github.com/kyverno/kyverno/pull/15947) - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16835](https://github.com/kyverno/kyverno/pull/16835) - fix: bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16782](https://github.com/kyverno/kyverno/pull/16782) - fix: evaluate resource filters from background scanning jobs by [@&#8203;sagarkhandagre998](https://github.com/sagarkhandagre998) in [#&#8203;16469](https://github.com/kyverno/kyverno/pull/16469) - feat: surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16868](https://github.com/kyverno/kyverno/pull/16868) - feat: remove kyverno-json support from api by [@&#8203;eddycharly](https://github.com/eddycharly) in [#&#8203;16792](https://github.com/kyverno/kyverno/pull/16792) - fix(dclient): use RESTMapper for GVK to GVR mapping by [@&#8203;FirePheonix](https://github.com/FirePheonix) in [#&#8203;16905](https://github.com/kyverno/kyverno/pull/16905) - Fix context propagation in MatchPolicyContext by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16910](https://github.com/kyverno/kyverno/pull/16910) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16913](https://github.com/kyverno/kyverno/pull/16913) - \[Bug Fix] Fix data race and goroutine leak in policy\_spec fuzzing on get bytes error by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16908](https://github.com/kyverno/kyverno/pull/16908) - chore(deps): Upgrade gotest.tools to v3 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16915](https://github.com/kyverno/kyverno/pull/16915) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16914](https://github.com/kyverno/kyverno/pull/16914) - chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16912](https://github.com/kyverno/kyverno/pull/16912) - chore: cut release v1.19.0-rc.1 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16922](https://github.com/kyverno/kyverno/pull/16922) - feat: remove kyverno-json from test api (Cherry-pick [#&#8203;16929](https://github.com/kyverno/kyverno/issues/16929)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16971](https://github.com/kyverno/kyverno/pull/16971) - feat: remove chainsaw tests using kyverno-json (Cherry-pick [#&#8203;16963](https://github.com/kyverno/kyverno/issues/16963)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16972](https://github.com/kyverno/kyverno/pull/16972) - feat: remove json scan command (Cherry-pick [#&#8203;16943](https://github.com/kyverno/kyverno/issues/16943)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16973](https://github.com/kyverno/kyverno/pull/16973) - fix: IVPOL required has no effect (Cherry-pick [#&#8203;16853](https://github.com/kyverno/kyverno/issues/16853)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16987](https://github.com/kyverno/kyverno/pull/16987) - fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick [#&#8203;16821](https://github.com/kyverno/kyverno/issues/16821)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17012](https://github.com/kyverno/kyverno/pull/17012) - feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick [#&#8203;16444](https://github.com/kyverno/kyverno/issues/16444)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17011](https://github.com/kyverno/kyverno/pull/17011) - fix(validation): reject non-string values in request.operation conditions (Cherry-pick [#&#8203;16977](https://github.com/kyverno/kyverno/issues/16977)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17013](https://github.com/kyverno/kyverno/pull/17013) - feat: remove reference to kyverno-json from go modules (cherry-pick [#&#8203;17005](https://github.com/kyverno/kyverno/issues/17005)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17010](https://github.com/kyverno/kyverno/pull/17010) - Fix goroutine and ticker leak in metrics initialization (Cherry-pick [#&#8203;17024](https://github.com/kyverno/kyverno/issues/17024)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17025](https://github.com/kyverno/kyverno/pull/17025) - Fix ticker leak in policyController background reconciliation loop (Cherry-pick [#&#8203;17027](https://github.com/kyverno/kyverno/issues/17027)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17030](https://github.com/kyverno/kyverno/pull/17030) - Fix context leak in TTL controller reconcile loop (Cherry-pick [#&#8203;17032](https://github.com/kyverno/kyverno/issues/17032)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17034](https://github.com/kyverno/kyverno/pull/17034) - Fix resource leak in sigstore fetchReferrers loop (Cherry-pick [#&#8203;17039](https://github.com/kyverno/kyverno/issues/17039)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17042](https://github.com/kyverno/kyverno/pull/17042) - fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick [#&#8203;17020](https://github.com/kyverno/kyverno/issues/17020)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17048](https://github.com/kyverno/kyverno/pull/17048) - fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick [#&#8203;17061](https://github.com/kyverno/kyverno/issues/17061)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17064](https://github.com/kyverno/kyverno/pull/17064) - fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick [#&#8203;17069](https://github.com/kyverno/kyverno/issues/17069)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17072](https://github.com/kyverno/kyverno/pull/17072) - chore: cut release v1.19.0-rc.2 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17073](https://github.com/kyverno/kyverno/pull/17073) - Fix ignored context in notary registry resolution (Cherry-pick [#&#8203;17078](https://github.com/kyverno/kyverno/issues/17078)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17079](https://github.com/kyverno/kyverno/pull/17079) - fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick [#&#8203;17087](https://github.com/kyverno/kyverno/issues/17087)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17091](https://github.com/kyverno/kyverno/pull/17091) - ci: add configurable code freeze check by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17095](https://github.com/kyverno/kyverno/pull/17095) - chore: cut release v1.19.0-rc.3 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17094](https://github.com/kyverno/kyverno/pull/17094) - fix(imageverify): repopulate intoto payload on attestation cache hit ([#&#8203;17117](https://github.com/kyverno/kyverno/issues/17117)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17195](https://github.com/kyverno/kyverno/pull/17195) - Release 1.19.0-rc.4 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17209](https://github.com/kyverno/kyverno/pull/17209) - chore: cut release v1.19.0 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17238](https://github.com/kyverno/kyverno/pull/17238) #### New Contributors - [@&#8203;pulkitvats2007-crypto](https://github.com/pulkitvats2007-crypto) made their first contribution in [#&#8203;15827](https://github.com/kyverno/kyverno/pull/15827) - [@&#8203;williamclot](https://github.com/williamclot) made their first contribution in [#&#8203;15754](https://github.com/kyverno/kyverno/pull/15754) - [@&#8203;mastersans](https://github.com/mastersans) made their first contribution in [#&#8203;16181](https://github.com/kyverno/kyverno/pull/16181) - [@&#8203;the-technat](https://github.com/the-technat) made their first contribution in [#&#8203;16161](https://github.com/kyverno/kyverno/pull/16161) - [@&#8203;naseyro](https://github.com/naseyro) made their first contribution in [#&#8203;16207](https://github.com/kyverno/kyverno/pull/16207) - [@&#8203;s3onghyun](https://github.com/s3onghyun) made their first contribution in [#&#8203;16279](https://github.com/kyverno/kyverno/pull/16279) - [@&#8203;7se7en72025](https://github.com/7se7en72025) made their first contribution in [#&#8203;16276](https://github.com/kyverno/kyverno/pull/16276) - [@&#8203;asiyani](https://github.com/asiyani) made their first contribution in [#&#8203;15824](https://github.com/kyverno/kyverno/pull/15824) - [@&#8203;senutpal](https://github.com/senutpal) made their first contribution in [#&#8203;16245](https://github.com/kyverno/kyverno/pull/16245) - [@&#8203;avoidik](https://github.com/avoidik) made their first contribution in [#&#8203;16280](https://github.com/kyverno/kyverno/pull/16280) - [@&#8203;Aneesh-Hegde](https://github.com/Aneesh-Hegde) made their first contribution in [#&#8203;16041](https://github.com/kyverno/kyverno/pull/16041) - [@&#8203;vmsilvamolina](https://github.com/vmsilvamolina) made their first contribution in [#&#8203;15872](https://github.com/kyverno/kyverno/pull/15872) - [@&#8203;Ebraam-Ashraf](https://github.com/Ebraam-Ashraf) made their first contribution in [#&#8203;16130](https://github.com/kyverno/kyverno/pull/16130) - [@&#8203;Proximyst](https://github.com/Proximyst) made their first contribution in [#&#8203;16301](https://github.com/kyverno/kyverno/pull/16301) - [@&#8203;dag-andersen](https://github.com/dag-andersen) made their first contribution in [#&#8203;16039](https://github.com/kyverno/kyverno/pull/16039) - [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) made their first contribution in [#&#8203;16162](https://github.com/kyverno/kyverno/pull/16162) - [@&#8203;khiemdoan](https://github.com/khiemdoan) made their first contribution in [#&#8203;16405](https://github.com/kyverno/kyverno/pull/16405) - [@&#8203;Utkal059](https://github.com/Utkal059) made their first contribution in [#&#8203;16296](https://github.com/kyverno/kyverno/pull/16296) - [@&#8203;pyd-07](https://github.com/pyd-07) made their first contribution in [#&#8203;16258](https://github.com/kyverno/kyverno/pull/16258) - [@&#8203;1vanden](https://github.com/1vanden) made their first contribution in [#&#8203;16252](https://github.com/kyverno/kyverno/pull/16252) - [@&#8203;InsomniaCoder](https://github.com/InsomniaCoder) made their first contribution in [#&#8203;15865](https://github.com/kyverno/kyverno/pull/15865) - [@&#8203;hugolevino](https://github.com/hugolevino) made their first contribution in [#&#8203;16298](https://github.com/kyverno/kyverno/pull/16298) - [@&#8203;AftAb-25](https://github.com/AftAb-25) made their first contribution in [#&#8203;16087](https://github.com/kyverno/kyverno/pull/16087) - [@&#8203;volantebjb](https://github.com/volantebjb) made their first contribution in [#&#8203;16239](https://github.com/kyverno/kyverno/pull/16239) - [@&#8203;p-fruck](https://github.com/p-fruck) made their first contribution in [#&#8203;16490](https://github.com/kyverno/kyverno/pull/16490) - [@&#8203;rootp1](https://github.com/rootp1) made their first contribution in [#&#8203;16544](https://github.com/kyverno/kyverno/pull/16544) - [@&#8203;Karthikk-18](https://github.com/Karthikk-18) made their first contribution in [#&#8203;16525](https://github.com/kyverno/kyverno/pull/16525) - [@&#8203;santhil-cyber](https://github.com/santhil-cyber) made their first contribution in [#&#8203;16292](https://github.com/kyverno/kyverno/pull/16292) - [@&#8203;Goutham-Annem](https://github.com/Goutham-Annem) made their first contribution in [#&#8203;16630](https://github.com/kyverno/kyverno/pull/16630) - [@&#8203;Iqrima](https://github.com/Iqrima) made their first contribution in [#&#8203;16625](https://github.com/kyverno/kyverno/pull/16625) - [@&#8203;farhan11166](https://github.com/farhan11166) made their first contribution in [#&#8203;16643](https://github.com/kyverno/kyverno/pull/16643) - [@&#8203;amarkdotdev](https://github.com/amarkdotdev) made their first contribution in [#&#8203;16305](https://github.com/kyverno/kyverno/pull/16305) - [@&#8203;bhuvan-somisetty](https://github.com/bhuvan-somisetty) made their first contribution in [#&#8203;16694](https://github.com/kyverno/kyverno/pull/16694) - [@&#8203;Prachidg](https://github.com/Prachidg) made their first contribution in [#&#8203;16431](https://github.com/kyverno/kyverno/pull/16431) - [@&#8203;tendinginfinity24](https://github.com/tendinginfinity24) made their first contribution in [#&#8203;16438](https://github.com/kyverno/kyverno/pull/16438) - [@&#8203;rseleven](https://github.com/rseleven) made their first contribution in [#&#8203;16591](https://github.com/kyverno/kyverno/pull/16591) - [@&#8203;Jayashanker-Padishala](https://github.com/Jayashanker-Padishala) made their first contribution in [#&#8203;16728](https://github.com/kyverno/kyverno/pull/16728) - [@&#8203;swastikCommits](https://github.com/swastikCommits) made their first contribution in [#&#8203;16751](https://github.com/kyverno/kyverno/pull/16751) - [@&#8203;kubeagon](https://github.com/kubeagon) made their first contribution in [#&#8203;15873](https://github.com/kyverno/kyverno/pull/15873) - [@&#8203;FirePheonix](https://github.com/FirePheonix) made their first contribution in [#&#8203;16905](https://github.com/kyverno/kyverno/pull/16905) - [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] made their first contribution in [#&#8203;16971](https://github.com/kyverno/kyverno/pull/16971) **Full Changelog**: <https://github.com/kyverno/kyverno/compare/v1.18.2...v1.19.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zNS4xIiwidXBkYXRlZEluVmVyIjoiNDQuMzUuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
volker.raschek was assigned by CSRBot 2026-08-20 11:09:18 +02:00
CSRBot added 1 commit 2026-08-21 17:09:22 +02:00
chore(deps): update dependency kyverno/kyverno to v1.19.0 4e348f208d
CSRBot force-pushed renovate/kyverno-kyverno-1.x from 367b4d936f to 4e348f208d 2026-08-21 17:09:22 +02:00 Compare
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/kyverno-kyverno-1.x:renovate/kyverno-kyverno-1.x
git checkout renovate/kyverno-kyverno-1.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees volker.raschek
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/kyverno-cli-bin-pkg#5