chore(deps): update dependency kyverno/kyverno to v1.19.1 - autoclosed #6

Closed

CSRBot wants to merge 1 commits from renovate/kyverno-kyverno-1.x into master

pull from: renovate/kyverno-kyverno-1.x

merge into: :master

:master

Conversation 0 Commits 1 Files Changed 1

+1 -1

CSRBot commented 2026-09-15 14:12:30 +02:00

Collaborator

Copy Link

Copy Source

This PR contains the following updates:

Package	Update	Change
kyverno/kyverno	minor	1.18.2 → 1.19.1

---

Release Notes

kyverno/kyverno (kyverno/kyverno)

v1.19.1

Compare Source

What's Changed

• fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by @​Manoj-Kumar-Selvaraj in #​17230
• fix: update Go to address CVE-2026-56853 by @​Sashang-debug in #​17232
• Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #​17262) by @​kyverno-pr-updater[bot] in #​17273
• fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #​17234) by @​realshuting in #​17298
• fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #​17299) by @​kyverno-pr-updater[bot] in #​17302
• fix: avoid data race in image evaluator prefetch (Cherry-pick #​17313) by @​kyverno-pr-updater[bot] in #​17327
• cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c) by @​realshuting in #​17307
• fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pick #​17310) by @​kyverno-pr-updater[bot] in #​17329
• fix(test): disable mutateDigest in exceptions-disabled IVPol by @​IceCodeBear in #​17336
• fix(test): loosen chainsaw stderr checks to contains by @​IceCodeBear in #​17334
• Bump kyverno sdk to 68d74af by @​raunak-nirmata in #​17349
• fix(test): disable IVPol digest defaults in leftover fixtures in v1.19 by @​IceCodeBear in #​17356
• fix(deps): bump golang.org/x/mod to v0.40.0 by @​IceCodeBear in #​17358
• fix: backport 7ac176a apiCall urlPath hardening to release-1.19 by @​realshuting in #​17361
• feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick #​17362) by @​kyverno-pr-updater[bot] in #​17378
• fix: validate PolicyException CEL match conditions (Cherry-pick #​17350) by @​kyverno-pr-updater[bot] in #​17373
• fix(test): disable IVPol digest defaults in leftover report fixtures by @​IceCodeBear in #​17376
• fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick #​17136) by @​kyverno-pr-updater[bot] in #​17430
• fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick #​17420) by @​kyverno-pr-updater[bot] in #​17435
• feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick #​17428) by @​kyverno-pr-updater[bot] in #​17434
• fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick #​17140) by @​kyverno-pr-updater[bot] in #​17437
• fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick #​16920) by @​kyverno-pr-updater[bot] in #​17446
• fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick #​16904) by @​kyverno-pr-updater[bot] in #​17454
• fix(webhook): avoid redundant recorder notifications (Cherry-pick #​17059) by @​kyverno-pr-updater[bot] in #​17451
• [release-1.19] fix: deny globalContext in namespaced policies (#​17377) by @​realshuting in #​17455
• [release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informer (#​16993) by @​realshuting in #​17464
• fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick #​17460) by @​kyverno-pr-updater[bot] in #​17480
• fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick #​16994) by @​kyverno-pr-updater[bot] in #​17498
• [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by @​realshuting in #​17513
• fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick #​17453) by @​kyverno-pr-updater[bot] in #​17520
• fix: skip scalar values during wildcard image extraction (Cherry-pick #​16268) by @​kyverno-pr-updater[bot] in #​17521
• chore: cut release v1.19.1-rc.1 by @​realshuting in #​17522
• feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick #​17014) by @​Rohanraj123 in #​17530
• fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick #​17395) by @​kyverno-pr-updater[bot] in #​17447
• chore: cut release v1.19.1 by @​realshuting in #​17541

New Contributors

• @​Manoj-Kumar-Selvaraj made their first contribution in #​17230

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• fix: limit intermediate certs to mitigate CVE-2026-32280 by @​atharrva01 in #​15858
• ci: fix cosign releaser step by @​lucchmielowski in #​15932
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @​dependabot[bot] in #​15917
• Feat/cli apply cross resource by @​SargamPuram in #​15846
• automate stale PR updates by @​JimBugwadia in #​15942
• fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by @​JimBugwadia in #​15960
• fix permissions for pr-branch-updater by @​JimBugwadia in #​15967
• use existing PR updater token by @​JimBugwadia in #​15974
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @​dependabot[bot] in #​15976
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @​dependabot[bot] in #​15943
• update blocklist to allow in-cluster HTTP calls by @​JimBugwadia in #​15973
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @​dependabot[bot] in #​15954
• chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @​dependabot[bot] in #​15961
• ci: Fix http conformance test blocklist by @​lucchmielowski in #​15986
• Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by @​rx18-eng in #​15733
• chore: update available versions in issues by @​lucchmielowski in #​15996
• test: add dpol controller integration tests by @​rx18-eng in #​15859
• test: add gpol exception and CEL edge case integration tests by @​rx18-eng in #​15787
• refactor: drop reliance on EnvSet in favor of in-library versioning by @​aerosouund in #​16014
• fix(jmespath): prevent panic in label_match on nested structures by @​pulkitvats2007-crypto in #​15827
• fix: retry on conflict when updating policy status by @​williamclot in #​15754
• fix: restart dynamic watchers in background reporting on 410 by @​aerosouund in #​16028
• chore: add framework tests github workflow by @​aerosouund in #​15743
• fix: support cluster-scoped resource generation in GeneratingPolicy by @​realshuting in #​16018
• fix: pass AdmissionRequest to updaterequests for mutate existing policy by @​realshuting in #​16050
• fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @​SargamPuram in #​15784
• ci: skip framework tests on docs-only and helm-only PRs by @​rx18-eng in #​16088
• fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @​SargamPuram in #​16034
• Fix/cli multiple json payloads by @​SargamPuram in #​15584
• feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @​SargamPuram in #​15948
• chore: add new gpol samples by @​realshuting in #​16097
• fix: validate name field in globalReference context entry by @​atharrva01 in #​16003
• fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @​liuxu623 in #​16099
• fix: skip report creation for subresources with empty name/UID by @​realshuting in #​16114
• feat: add updaterequest total gauge metric by @​realshuting in #​16115
• feat(helm): support extraArgs in CRDs migration job by @​Suhani95 in #​16132
• feat: add non-goals by @​realshuting in #​16144
• chore: point to security assessments by @​realshuting in #​16145
• chore: update dependency policy by @​realshuting in #​16150
• fix(engine/vpol): include CEL validation expression index in policy report properties by @​Rohanraj123 in #​15916
• feat(helm): add optional PrometheusRule template by @​realshuting in #​16155
• chore: clarify performance baselines by @​realshuting in #​16154
• feat: update api docs by @​realshuting in #​16143
• feat: add NOTICE and embed attribution in container images by @​realshuting in #​16151
• feat: add opertional runbook by @​realshuting in #​16149
• feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @​SargamPuram in #​16123
• fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @​yashrajshuklaaa in #​16167
• fix(Makefile): wire readiness-checker into local kind dev workflow by @​mastersans in #​16181
• test: add NewTestEnvWithOptions for opt-in policy type wiring by @​rx18-eng in #​16005
• fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by @​sandert-k8s in #​16055
• docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by @​realshuting in #​16197
• test: add additional dpol controller integration tests by @​rx18-eng in #​15966
• ci: cache envtest binaries between framework test runs by @​rx18-eng in #​16110
• fix(dpol): apply namespaceSelector against Namespace resource own labels by @​realshuting in #​16200
• fix: do not abort required validation on non-matching images by @​lucchmielowski in #​16208
• fix(cli): allow multiple CRDs in to be in the --crd-path file by @​the-technat in #​16161
• test(integration): migrate gpol sync-clone scenarios from chainsaw by @​rx18-eng in #​16206
• fix: add the readiness checker to the ci image archive by @​aerosouund in #​16220
• fix: add access to clusterroles and bindings in the standard kyverno config by @​aerosouund in #​16219
• feat: Enable Cosign verbosity debugging by @​naseyro in #​16207
• chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by @​realshuting in #​16241
• ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by @​rx18-eng in #​16273
• fix: support cel exception in cli apply 'exceptions-within-resources' by @​bakito in #​16178
• docs: fix duplicated word in cleanuppolicy validateAuth comment by @​s3onghyun in #​16279
• return correct results for NotEquals type mismatch cases by @​7se7en72025 in #​16276
• feat(cli): support multiple CRD paths and hook CRD processor into test command by @​asiyani in #​15824
• fix: wire gpolEngine and gpolProvider into policyController by @​yashrajshuklaaa in #​16171
• fix: nil pointer panic in getGpolTriggers on ListResource error by @​senutpal in #​16245
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by @​dependabot[bot] in #​16045
• Fix UR regression by @​avoidik in #​16280
• Fix context and SyncWatchers race conditions in GeneratingPolicy by @​Aneesh-Hegde in #​16041
• feat(pss-helm): add image to allowed volumetypes by @​yehlo in #​15906
• fix(generate): batch UpdateRequests to avoid etcd size limit by @​vmsilvamolina in #​15872
• fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @​realshuting in #​16329
• fix(background): remove dead watcher entry on goroutine exit by @​Ebraam-Ashraf in #​16130
• fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by @​realshuting in #​16340
• fix(generate): support NamespacedGeneratingPolicy end-to-end by @​realshuting in #​16338
• feat: honor expired CEL PolicyExceptions by @​realshuting in #​16299
• fix(background): scan NamespacedImageValidatingPolicy resources too by @​Proximyst in #​16301
• fix: validate stdin across apply paths by @​karthikmanam in #​16347
• feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @​SargamPuram in #​16297
• fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by @​ANAMASGARD in #​16291
• chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by @​dependabot[bot] in #​16371
• fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by @​aditip149209 in #​16361
• fix(deps): upgrade ristretto to v2 by @​chimanjain in #​16360
• fix: unblock ko image publish by replacing escaping kodata symlinks by @​realshuting in #​16381
• chore(workflow): dynamically discover active branches for Trivy issue sync by @​realshuting in #​16377
• fix CEL autogen namespace replacement by @​dag-andersen in #​16039
• fix(gpol): support mixed-type aggregate literals in CEL variables by @​realshuting in #​16339
• docs: fix README workflow badge and AI policy link by @​ObaidAbdullah16 in #​16162
• fix(deps): bump rekor and in-toto-golang for codeql alerts by @​realshuting in #​16394
• test: fix webhook registration typo by @​ObaidAbdullah16 in #​16164
• feat: support skipBackgroundRequests for CEL mpol/gpol by @​realshuting in #​16369
• test(chainsaw): fix NIVP background + clone-multiple-targets setup by @​realshuting in #​16399
• chore: update pond dependency to v2 by @​chimanjain in #​16379
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by @​dependabot[bot] in #​16402
• Update backoff v7 by @​khiemdoan in #​16405
• Don't initialize rekor client for key or certificate based scenarios by @​aerosouund in #​16415
• chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by @​dependabot[bot] in #​15939
• test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by @​realshuting in #​16414
• chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by @​dependabot[bot] in #​15991
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by @​dependabot[bot] in #​16420
• test(integration): add YAML fixture loaders for the framework by @​rx18-eng in #​16229
• fix: preserve cluster-scoped generated resources by @​Suhani95 in #​16362
• fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by @​realshuting in #​16426
• feat(gpol): support useServerSideApply for GeneratingPolicy by @​realshuting in #​16403
• fix(api): use allPath instead of anyPath in m.All validation loop by @​Utkal059 in #​16296
• fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #​16256 by @​pyd-07 in #​16258
• fix(ci): use server-side apply for conformance CRD refresh by @​realshuting in #​16429
• fix: add sorting for ivpol targets by @​1vanden in #​16252
• fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @​InsomniaCoder in #​15865
• fix(ci): force conflicts when server-side applying conformance CRDs by @​realshuting in #​16432
• fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @​sandert-k8s in #​16255
• fix(reports): correct label prefix for mpol/dpol policies by @​atharrva01 in #​16452
• fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @​hugolevino in #​16298
• fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @​ANAMASGARD in #​16287
• chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by @​dependabot[bot] in #​16442
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @​dependabot[bot] in #​16441
• fix: resolve context leak in dynamic resource watcher by @​AftAb-25 in #​16087
• feat(gpol): add auditAnnotations support to GeneratingPolicy by @​realshuting in #​16505
• fix: add policies.kyverno.io resources to aggregate policy roles by @​volantebjb in #​16239
• fix: address open CodeQL security vulnerabilities by @​realshuting in #​16528
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @​dependabot[bot] in #​16516
• chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @​dependabot[bot] in #​16515
• Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @​chimanjain in #​16511
• fix: skip reports RBAC check when background scanning is disabled by @​p-fruck in #​16490
• fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @​rootp1 in #​16544
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by @​dependabot[bot] in #​16010
• chore(deps): bump the otel group across 1 directory with 4 updates by @​dependabot[bot] in #​16539
• chore(deps): bump Homebrew/actions/limit-pull-requests from 9ceb793 to 18fcb8e by @​dependabot[bot] in #​16562
• Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by @​Suhani95 in #​16572
• fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @​Karthikk-18 in #​16525
• chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by @​dependabot[bot] in #​16573
• chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @​dependabot[bot] in #​16575
• fix(chart): wire cleanup controller core extra resources by @​Suhani95 in #​16165
• fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @​rx18-eng in #​16561
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by @​dependabot[bot] in #​16574
• fix: avoid mutating policy webhook name collisions by @​realshuting in #​16578
• fix: add missing reportProperties to v2beta1 Rule by @​zyzzmohit in #​15564
• test(integration): single-pass report aggregation helper + flagship test by @​rx18-eng in #​16244
• ci: add Semgrep SAST workflow by @​IceCodeBear in #​16464
• fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @​AftAb-25 in #​16063
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​16576
• fix: key generate test clone sources by policy by @​Suhani95 in #​16450
• Fix: require --resource for migrate command by @​Suhani95 in #​16471
• fix(admissionpolicy): default userInfo groups and uid during background scans by @​rx18-eng in #​16592
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @​dependabot[bot] in #​16598
• fix: handle whitespace in mpol autogen Object constructor by @​santhil-cyber in #​16292
• chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @​dependabot[bot] in #​16599
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @​dependabot[bot] in #​16600
• fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @​pyd-07 in #​16588
• fix(mpol): handle DELETE target expression using oldObject by @​realshuting in #​16610
• fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @​rx18-eng in #​16611
• fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by @​Goutham-Annem in #​16630
• fix: add subtests and fix typo in ext/wildcard/match_test.go by @​Iqrima in #​16625
• fix: resolve error shadowing in SplitDocuments signature by @​Iqrima in #​16632
• fix: CustomNamespaceLister.List honors the label selector by @​7se7en72025 in #​16628
• chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​16621
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @​dependabot[bot] in #​16619
• ci: migrate pr-branch-updater to GitHub App auth by @​JimBugwadia in #​16662
• chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @​dependabot[bot] in #​16620
• fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @​rx18-eng in #​16509
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​dependabot[bot] in #​16669
• chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @​dependabot[bot] in #​16670
• refactor: add context propagation to background util functions by @​farhan11166 in #​16643
• cleanup: remove dead fakeContext code by @​aerosouund in #​16675
• feat: support MutatingPolicy target conditions and subresource targets by @​realshuting in #​16614
• fix(webhook): scope namespaced policies to their own namespace by @​rx18-eng in #​16615
• chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by @​dependabot[bot] in #​16684
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by @​dependabot[bot] in #​16681
• chore: bump controller-tools by @​eddycharly in #​16687
• fix: make file extension checks case-insensitive by @​Iqrima in #​16689
• chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​16668
• fix(ivpol): add debug logging for CEL image verification functions by @​amarkdotdev in #​16305
• test: point ivpol cosign tests at the kyverno test-images registry by @​rx18-eng in #​16695
• feat: reuse image verification cache for ImageValidatingPolicy by @​bhuvan-somisetty in #​16694
• fix: enforce MutatingPolicy evaluation mode semantics by @​realshuting in #​16686
• ci: assign release milestone to PRs automatically at release time by @​JimBugwadia in #​16661
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​16679
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in #​16680
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @​dependabot[bot] in #​16697
• fix: validate MAP-incompatible MutatingPolicy match conditions by @​realshuting in #​16698
• fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @​rx18-eng in #​16594
• fix(generate): reject stale trigger UIDs when live resource does not match by @​ANAMASGARD in #​16603
• Image verification credential handling refactor by @​aerosouund in #​16439
• fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @​JimBugwadia in #​16666
• feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @​realshuting in #​16699
• feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @​realshuting in #​16703
• fix: strip cross-namespace ownerReferences in CEL-based generation by @​realshuting in #​16716
• Fix DeletingPolicy objectSelector test results by @​Prachidg in #​16431
• feat(cel): add regex.replace extension function by @​tendinginfinity24 in #​16438
• fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @​realshuting in #​16727
• fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @​JimBugwadia in #​16663
• fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @​rseleven in #​16591
• fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @​rx18-eng in #​16731
• test(integration): add ImageValidatingPolicy support to the framework by @​rx18-eng in #​16730
• feat(mpol): add auditAnnotations support to MutatingPolicy by @​realshuting in #​16721
• fix: preserve namespaceSelector during policy autogen by @​pyd-07 in #​16476
• fix: align policy metrics for new policy formats by @​aditip149209 in #​16359
• fix: validate DeletingPolicy cron schedule at admission by @​Jayashanker-Padishala in #​16728
• [Feature] add optional cache bounds via --maxGlobalContextEntries by @​IceCodeBear in #​16560
• fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by @​rx18-eng in #​16397
• fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @​rx18-eng in #​16434
• fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @​realshuting in #​16739
• fix(helm): use request.namespace for vpolExclude matchConditions by @​swastikCommits in #​16751
• test(integration): align ivpol framework tests with single-phase image verification by @​rx18-eng in #​16741
• feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @​IceCodeBear in #​16749
• chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @​dependabot[bot] in #​16770
• chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @​dependabot[bot] in #​16767
• chore(deps): bump the kubernetes group across 3 directories with 7 updates by @​dependabot[bot] in #​16737
• chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @​dependabot[bot] in #​16738
• restrict issue self-assignment to good first issues for non-members by @​realshuting in #​16776
• chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by @​dependabot[bot] in #​16735
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in #​16733
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​16734
• fix: resolve namespaceObject with live API fallback on informer cache miss by @​realshuting in #​16784
• fix(cli): evaluate mutateExisting mutating policies on admission in test by @​rx18-eng in #​16618
• feat(cli): support admission operation simulation for policy testing by @​realshuting in #​16787
• fix: honor full-exemption PolicyException when multiple exceptions match by @​AftAb-25 in #​16060
• fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @​Suhani95 in #​16249
• fix(engine): honor per-rule failureAction in the admission block deci… by @​rx18-eng in #​16558
• Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @​kubeagon in #​15873
• fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @​realshuting in #​16804
• Fix image verification parity gaps by @​JimBugwadia in #​16800
• chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by @​dependabot[bot] in #​16802
• fix: IVPOL mutateDigest unimplemented stub by @​lucchmielowski in #​16815
• chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by @​dependabot[bot] in #​16818
• fix: enforce verifyDigest in ImageValidatingPolicy evaluator by @​pyd-07 in #​16817
• chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by @​dependabot[bot] in #​16837
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by @​dependabot[bot] in #​16836
• chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @​dependabot[bot] in #​16834
• fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by @​realshuting in #​16838
• fix: prevent autogen from rewriting namespaceObject in mpol by @​lucchmielowski in #​15947
• chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in #​16835
• fix: bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g by @​itsvishalyadav in #​16782
• fix: evaluate resource filters from background scanning jobs by @​sagarkhandagre998 in #​16469
• feat: surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default) by @​realshuting in #​16868
• feat: remove kyverno-json support from api by @​eddycharly in #​16792
• fix(dclient): use RESTMapper for GVK to GVR mapping by @​FirePheonix in #​16905
• Fix context propagation in MatchPolicyContext by @​itsvishalyadav in #​16910
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​16913
• [Bug Fix] Fix data race and goroutine leak in policy_spec fuzzing on get bytes error by @​itsvishalyadav in #​16908
• chore(deps): Upgrade gotest.tools to v3 by @​chimanjain in #​16915
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12 by @​dependabot[bot] in #​16914
• chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @​dependabot[bot] in #​16912
• chore: cut release v1.19.0-rc.1 by @​realshuting in #​16922
• feat: remove kyverno-json from test api (Cherry-pick #​16929) by @​kyverno-pr-updater[bot] in #​16971
• feat: remove chainsaw tests using kyverno-json (Cherry-pick #​16963) by @​kyverno-pr-updater[bot] in #​16972
• feat: remove json scan command (Cherry-pick #​16943) by @​kyverno-pr-updater[bot] in #​16973
• fix: IVPOL required has no effect (Cherry-pick #​16853) by @​kyverno-pr-updater[bot] in #​16987
• fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick #​16821) by @​kyverno-pr-updater[bot] in #​17012
• feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick #​16444) by @​kyverno-pr-updater[bot] in #​17011
• fix(validation): reject non-string values in request.operation conditions (Cherry-pick #​16977) by @​kyverno-pr-updater[bot] in #​17013
• feat: remove reference to kyverno-json from go modules (cherry-pick #​17005) by @​realshuting in #​17010
• Fix goroutine and ticker leak in metrics initialization (Cherry-pick #​17024) by @​kyverno-pr-updater[bot] in #​17025
• Fix ticker leak in policyController background reconciliation loop (Cherry-pick #​17027) by @​kyverno-pr-updater[bot] in #​17030
• Fix context leak in TTL controller reconcile loop (Cherry-pick #​17032) by @​kyverno-pr-updater[bot] in #​17034
• Fix resource leak in sigstore fetchReferrers loop (Cherry-pick #​17039) by @​kyverno-pr-updater[bot] in #​17042
• fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick #​17020) by @​kyverno-pr-updater[bot] in #​17048
• fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick #​17061) by @​kyverno-pr-updater[bot] in #​17064
• fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick #​17069) by @​kyverno-pr-updater[bot] in #​17072
• chore: cut release v1.19.0-rc.2 by @​realshuting in #​17073
• Fix ignored context in notary registry resolution (Cherry-pick #​17078) by @​kyverno-pr-updater[bot] in #​17079
• fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick #​17087) by @​kyverno-pr-updater[bot] in #​17091
• ci: add configurable code freeze check by @​realshuting in #​17095
• chore: cut release v1.19.0-rc.3 by @​realshuting in #​17094
• fix(imageverify): repopulate intoto payload on attestation cache hit (#​17117) by @​realshuting in #​17195
• Release 1.19.0-rc.4 by @​realshuting in #​17209
• chore: cut release v1.19.0 by @​realshuting in #​17238

New Contributors

• @​pulkitvats2007-crypto made their first contribution in #​15827
• @​williamclot made their first contribution in #​15754
• @​mastersans made their first contribution in #​16181
• @​the-technat made their first contribution in #​16161
• @​naseyro made their first contribution in #​16207
• @​s3onghyun made their first contribution in #​16279
• @​7se7en72025 made their first contribution in #​16276
• @​asiyani made their first contribution in #​15824
• @​senutpal made their first contribution in #​16245
• @​avoidik made their first contribution in #​16280
• @​Aneesh-Hegde made their first contribution in #​16041
• @​vmsilvamolina made their first contribution in #​15872
• @​Ebraam-Ashraf made their first contribution in #​16130
• @​Proximyst made their first contribution in #​16301
• @​dag-andersen made their first contribution in #​16039
• @​ObaidAbdullah16 made their first contribution in #​16162
• @​khiemdoan made their first contribution in #​16405
• @​Utkal059 made their first contribution in #​16296
• @​pyd-07 made their first contribution in #​16258
• @​1vanden made their first contribution in #​16252
• @​InsomniaCoder made their first contribution in #​15865
• @​hugolevino made their first contribution in #​16298
• @​AftAb-25 made their first contribution in #​16087
• @​volantebjb made their first contribution in #​16239
• @​p-fruck made their first contribution in #​16490
• @​rootp1 made their first contribution in #​16544
• @​Karthikk-18 made their first contribution in #​16525
• @​santhil-cyber made their first contribution in #​16292
• @​Goutham-Annem made their first contribution in #​16630
• @​Iqrima made their first contribution in #​16625
• @​farhan11166 made their first contribution in #​16643
• @​amarkdotdev made their first contribution in #​16305
• @​bhuvan-somisetty made their first contribution in #​16694
• @​Prachidg made their first contribution in #​16431
• @​tendinginfinity24 made their first contribution in #​16438
• @​rseleven made their first contribution in #​16591
• @​Jayashanker-Padishala made their first contribution in #​16728
• @​swastikCommits made their first contribution in #​16751
• @​kubeagon made their first contribution in #​15873
• @​FirePheonix made their first contribution in #​16905
• @​kyverno-pr-updater[bot] made their first contribution in #​16971

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.18.2...v1.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kyverno/kyverno](https://github.com/kyverno/kyverno) | minor | `1.18.2` → `1.19.1` | --- ### Release Notes <details> <summary>kyverno/kyverno (kyverno/kyverno)</summary> ### [`v1.19.1`](https://github.com/kyverno/kyverno/releases/tag/v1.19.1) [Compare Source](https://github.com/kyverno/kyverno/compare/v1.19.0-rc.4...v1.19.1-rc.1) #### What's Changed - fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by [@&#8203;Manoj-Kumar-Selvaraj](https://github.com/Manoj-Kumar-Selvaraj) in [#&#8203;17230](https://github.com/kyverno/kyverno/pull/17230) - fix: update Go to address CVE-2026-56853 by [@&#8203;Sashang-debug](https://github.com/Sashang-debug) in [#&#8203;17232](https://github.com/kyverno/kyverno/pull/17232) - Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick [#&#8203;17262](https://github.com/kyverno/kyverno/issues/17262)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17273](https://github.com/kyverno/kyverno/pull/17273) - fix: apply HTTP blocklist to apiCall.service executor (cherry-pick [#&#8203;17234](https://github.com/kyverno/kyverno/issues/17234)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17298](https://github.com/kyverno/kyverno/pull/17298) - fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick [#&#8203;17299](https://github.com/kyverno/kyverno/issues/17299)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17302](https://github.com/kyverno/kyverno/pull/17302) - fix: avoid data race in image evaluator prefetch (Cherry-pick [#&#8203;17313](https://github.com/kyverno/kyverno/issues/17313)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17327](https://github.com/kyverno/kyverno/pull/17327) - cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17307](https://github.com/kyverno/kyverno/pull/17307) - fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pick [#&#8203;17310](https://github.com/kyverno/kyverno/issues/17310)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17329](https://github.com/kyverno/kyverno/pull/17329) - fix(test): disable mutateDigest in exceptions-disabled IVPol by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;17336](https://github.com/kyverno/kyverno/pull/17336) - fix(test): loosen chainsaw stderr checks to contains by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;17334](https://github.com/kyverno/kyverno/pull/17334) - Bump kyverno sdk to [`68d74af`](https://github.com/kyverno/kyverno/commit/68d74afcb07a) by [@&#8203;raunak-nirmata](https://github.com/raunak-nirmata) in [#&#8203;17349](https://github.com/kyverno/kyverno/pull/17349) - fix(test): disable IVPol digest defaults in leftover fixtures in v1.19 by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;17356](https://github.com/kyverno/kyverno/pull/17356) - fix(deps): bump golang.org/x/mod to v0.40.0 by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;17358](https://github.com/kyverno/kyverno/pull/17358) - fix: backport [`7ac176a`](https://github.com/kyverno/kyverno/commit/7ac176ac) apiCall urlPath hardening to release-1.19 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17361](https://github.com/kyverno/kyverno/pull/17361) - feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick [#&#8203;17362](https://github.com/kyverno/kyverno/issues/17362)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17378](https://github.com/kyverno/kyverno/pull/17378) - fix: validate PolicyException CEL match conditions (Cherry-pick [#&#8203;17350](https://github.com/kyverno/kyverno/issues/17350)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17373](https://github.com/kyverno/kyverno/pull/17373) - fix(test): disable IVPol digest defaults in leftover report fixtures by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;17376](https://github.com/kyverno/kyverno/pull/17376) - fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick [#&#8203;17136](https://github.com/kyverno/kyverno/issues/17136)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17430](https://github.com/kyverno/kyverno/pull/17430) - fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick [#&#8203;17420](https://github.com/kyverno/kyverno/issues/17420)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17435](https://github.com/kyverno/kyverno/pull/17435) - feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick [#&#8203;17428](https://github.com/kyverno/kyverno/issues/17428)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17434](https://github.com/kyverno/kyverno/pull/17434) - fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick [#&#8203;17140](https://github.com/kyverno/kyverno/issues/17140)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17437](https://github.com/kyverno/kyverno/pull/17437) - fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick [#&#8203;16920](https://github.com/kyverno/kyverno/issues/16920)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17446](https://github.com/kyverno/kyverno/pull/17446) - fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick [#&#8203;16904](https://github.com/kyverno/kyverno/issues/16904)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17454](https://github.com/kyverno/kyverno/pull/17454) - fix(webhook): avoid redundant recorder notifications (Cherry-pick [#&#8203;17059](https://github.com/kyverno/kyverno/issues/17059)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17451](https://github.com/kyverno/kyverno/pull/17451) - \[release-1.19] fix: deny globalContext in namespaced policies ([#&#8203;17377](https://github.com/kyverno/kyverno/issues/17377)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17455](https://github.com/kyverno/kyverno/pull/17455) - \[release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informer ([#&#8203;16993](https://github.com/kyverno/kyverno/issues/16993)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17464](https://github.com/kyverno/kyverno/pull/17464) - fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick [#&#8203;17460](https://github.com/kyverno/kyverno/issues/17460)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17480](https://github.com/kyverno/kyverno/pull/17480) - fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick [#&#8203;16994](https://github.com/kyverno/kyverno/issues/16994)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17498](https://github.com/kyverno/kyverno/pull/17498) - \[release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17513](https://github.com/kyverno/kyverno/pull/17513) - fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick [#&#8203;17453](https://github.com/kyverno/kyverno/issues/17453)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17520](https://github.com/kyverno/kyverno/pull/17520) - fix: skip scalar values during wildcard image extraction (Cherry-pick [#&#8203;16268](https://github.com/kyverno/kyverno/issues/16268)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17521](https://github.com/kyverno/kyverno/pull/17521) - chore: cut release v1.19.1-rc.1 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17522](https://github.com/kyverno/kyverno/pull/17522) - feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick [#&#8203;17014](https://github.com/kyverno/kyverno/issues/17014)) by [@&#8203;Rohanraj123](https://github.com/Rohanraj123) in [#&#8203;17530](https://github.com/kyverno/kyverno/pull/17530) - fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick [#&#8203;17395](https://github.com/kyverno/kyverno/issues/17395)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17447](https://github.com/kyverno/kyverno/pull/17447) - chore: cut release v1.19.1 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17541](https://github.com/kyverno/kyverno/pull/17541) #### New Contributors - [@&#8203;Manoj-Kumar-Selvaraj](https://github.com/Manoj-Kumar-Selvaraj) made their first contribution in [#&#8203;17230](https://github.com/kyverno/kyverno/pull/17230) **Full Changelog**: <https://github.com/kyverno/kyverno/compare/v1.19.0...v1.19.1> ### [`v1.19.0`](https://github.com/kyverno/kyverno/releases/tag/v1.19.0) [Compare Source](https://github.com/kyverno/kyverno/compare/v1.18.2-rc.1...v1.19.0-rc.4) #### What's Changed - fix: limit intermediate certs to mitigate CVE-2026-32280 by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;15858](https://github.com/kyverno/kyverno/pull/15858) - ci: fix cosign releaser step by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15932](https://github.com/kyverno/kyverno/pull/15932) - chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15917](https://github.com/kyverno/kyverno/pull/15917) - Feat/cli apply cross resource by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15846](https://github.com/kyverno/kyverno/pull/15846) - automate stale PR updates by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15942](https://github.com/kyverno/kyverno/pull/15942) - fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15960](https://github.com/kyverno/kyverno/pull/15960) - fix permissions for pr-branch-updater by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15967](https://github.com/kyverno/kyverno/pull/15967) - use existing PR updater token by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15974](https://github.com/kyverno/kyverno/pull/15974) - chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15976](https://github.com/kyverno/kyverno/pull/15976) - chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15943](https://github.com/kyverno/kyverno/pull/15943) - update blocklist to allow in-cluster HTTP calls by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;15973](https://github.com/kyverno/kyverno/pull/15973) - chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15954](https://github.com/kyverno/kyverno/pull/15954) - chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15961](https://github.com/kyverno/kyverno/pull/15961) - ci: Fix http conformance test blocklist by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15986](https://github.com/kyverno/kyverno/pull/15986) - Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15733](https://github.com/kyverno/kyverno/pull/15733) - chore: update available versions in issues by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15996](https://github.com/kyverno/kyverno/pull/15996) - test: add dpol controller integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15859](https://github.com/kyverno/kyverno/pull/15859) - test: add gpol exception and CEL edge case integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15787](https://github.com/kyverno/kyverno/pull/15787) - refactor: drop reliance on EnvSet in favor of in-library versioning by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16014](https://github.com/kyverno/kyverno/pull/16014) - fix(jmespath): prevent panic in label\_match on nested structures by [@&#8203;pulkitvats2007-crypto](https://github.com/pulkitvats2007-crypto) in [#&#8203;15827](https://github.com/kyverno/kyverno/pull/15827) - fix: retry on conflict when updating policy status by [@&#8203;williamclot](https://github.com/williamclot) in [#&#8203;15754](https://github.com/kyverno/kyverno/pull/15754) - fix: restart dynamic watchers in background reporting on 410 by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16028](https://github.com/kyverno/kyverno/pull/16028) - chore: add framework tests github workflow by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;15743](https://github.com/kyverno/kyverno/pull/15743) - fix: support cluster-scoped resource generation in GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16018](https://github.com/kyverno/kyverno/pull/16018) - fix: pass AdmissionRequest to updaterequests for mutate existing policy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16050](https://github.com/kyverno/kyverno/pull/16050) - fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15784](https://github.com/kyverno/kyverno/pull/15784) - ci: skip framework tests on docs-only and helm-only PRs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16088](https://github.com/kyverno/kyverno/pull/16088) - fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16034](https://github.com/kyverno/kyverno/pull/16034) - Fix/cli multiple json payloads by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15584](https://github.com/kyverno/kyverno/pull/15584) - feat(cli): add offline mock support for http mock request/response for GET method and global context entries by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;15948](https://github.com/kyverno/kyverno/pull/15948) - chore: add new gpol samples by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16097](https://github.com/kyverno/kyverno/pull/16097) - fix: validate name field in globalReference context entry by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;16003](https://github.com/kyverno/kyverno/pull/16003) - fix(gctx): correctly track per-loader load state to avoid skipping LoadData by [@&#8203;liuxu623](https://github.com/liuxu623) in [#&#8203;16099](https://github.com/kyverno/kyverno/pull/16099) - fix: skip report creation for subresources with empty name/UID by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16114](https://github.com/kyverno/kyverno/pull/16114) - feat: add updaterequest total gauge metric by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16115](https://github.com/kyverno/kyverno/pull/16115) - feat(helm): support extraArgs in CRDs migration job by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16132](https://github.com/kyverno/kyverno/pull/16132) - feat: add non-goals by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16144](https://github.com/kyverno/kyverno/pull/16144) - chore: point to security assessments by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16145](https://github.com/kyverno/kyverno/pull/16145) - chore: update dependency policy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16150](https://github.com/kyverno/kyverno/pull/16150) - fix(engine/vpol): include CEL validation expression index in policy report properties by [@&#8203;Rohanraj123](https://github.com/Rohanraj123) in [#&#8203;15916](https://github.com/kyverno/kyverno/pull/15916) - feat(helm): add optional PrometheusRule template by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16155](https://github.com/kyverno/kyverno/pull/16155) - chore: clarify performance baselines by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16154](https://github.com/kyverno/kyverno/pull/16154) - feat: update api docs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16143](https://github.com/kyverno/kyverno/pull/16143) - feat: add NOTICE and embed attribution in container images by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16151](https://github.com/kyverno/kyverno/pull/16151) - feat: add opertional runbook by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16149](https://github.com/kyverno/kyverno/pull/16149) - feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16123](https://github.com/kyverno/kyverno/pull/16123) - fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by [@&#8203;yashrajshuklaaa](https://github.com/yashrajshuklaaa) in [#&#8203;16167](https://github.com/kyverno/kyverno/pull/16167) - fix(Makefile): wire readiness-checker into local kind dev workflow by [@&#8203;mastersans](https://github.com/mastersans) in [#&#8203;16181](https://github.com/kyverno/kyverno/pull/16181) - test: add NewTestEnvWithOptions for opt-in policy type wiring by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16005](https://github.com/kyverno/kyverno/pull/16005) - fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by [@&#8203;sandert-k8s](https://github.com/sandert-k8s) in [#&#8203;16055](https://github.com/kyverno/kyverno/pull/16055) - docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16197](https://github.com/kyverno/kyverno/pull/16197) - test: add additional dpol controller integration tests by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;15966](https://github.com/kyverno/kyverno/pull/15966) - ci: cache envtest binaries between framework test runs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16110](https://github.com/kyverno/kyverno/pull/16110) - fix(dpol): apply namespaceSelector against Namespace resource own labels by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16200](https://github.com/kyverno/kyverno/pull/16200) - fix: do not abort required validation on non-matching images by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;16208](https://github.com/kyverno/kyverno/pull/16208) - fix(cli): allow multiple CRDs in to be in the --crd-path file by [@&#8203;the-technat](https://github.com/the-technat) in [#&#8203;16161](https://github.com/kyverno/kyverno/pull/16161) - test(integration): migrate gpol sync-clone scenarios from chainsaw by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16206](https://github.com/kyverno/kyverno/pull/16206) - fix: add the readiness checker to the ci image archive by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16220](https://github.com/kyverno/kyverno/pull/16220) - fix: add access to clusterroles and bindings in the standard kyverno config by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16219](https://github.com/kyverno/kyverno/pull/16219) - feat: Enable Cosign verbosity debugging by [@&#8203;naseyro](https://github.com/naseyro) in [#&#8203;16207](https://github.com/kyverno/kyverno/pull/16207) - chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16241](https://github.com/kyverno/kyverno/pull/16241) - ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16273](https://github.com/kyverno/kyverno/pull/16273) - fix: support cel exception in cli apply 'exceptions-within-resources' by [@&#8203;bakito](https://github.com/bakito) in [#&#8203;16178](https://github.com/kyverno/kyverno/pull/16178) - docs: fix duplicated word in cleanuppolicy validateAuth comment by [@&#8203;s3onghyun](https://github.com/s3onghyun) in [#&#8203;16279](https://github.com/kyverno/kyverno/pull/16279) - return correct results for NotEquals type mismatch cases by [@&#8203;7se7en72025](https://github.com/7se7en72025) in [#&#8203;16276](https://github.com/kyverno/kyverno/pull/16276) - feat(cli): support multiple CRD paths and hook CRD processor into test command by [@&#8203;asiyani](https://github.com/asiyani) in [#&#8203;15824](https://github.com/kyverno/kyverno/pull/15824) - fix: wire gpolEngine and gpolProvider into policyController by [@&#8203;yashrajshuklaaa](https://github.com/yashrajshuklaaa) in [#&#8203;16171](https://github.com/kyverno/kyverno/pull/16171) - fix: nil pointer panic in getGpolTriggers on ListResource error by [@&#8203;senutpal](https://github.com/senutpal) in [#&#8203;16245](https://github.com/kyverno/kyverno/pull/16245) - chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16045](https://github.com/kyverno/kyverno/pull/16045) - Fix UR regression by [@&#8203;avoidik](https://github.com/avoidik) in [#&#8203;16280](https://github.com/kyverno/kyverno/pull/16280) - Fix context and SyncWatchers race conditions in GeneratingPolicy by [@&#8203;Aneesh-Hegde](https://github.com/Aneesh-Hegde) in [#&#8203;16041](https://github.com/kyverno/kyverno/pull/16041) - feat(pss-helm): add image to allowed volumetypes by [@&#8203;yehlo](https://github.com/yehlo) in [#&#8203;15906](https://github.com/kyverno/kyverno/pull/15906) - fix(generate): batch UpdateRequests to avoid etcd size limit by [@&#8203;vmsilvamolina](https://github.com/vmsilvamolina) in [#&#8203;15872](https://github.com/kyverno/kyverno/pull/15872) - fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16329](https://github.com/kyverno/kyverno/pull/16329) - fix(background): remove dead watcher entry on goroutine exit by [@&#8203;Ebraam-Ashraf](https://github.com/Ebraam-Ashraf) in [#&#8203;16130](https://github.com/kyverno/kyverno/pull/16130) - fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16340](https://github.com/kyverno/kyverno/pull/16340) - fix(generate): support NamespacedGeneratingPolicy end-to-end by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16338](https://github.com/kyverno/kyverno/pull/16338) - feat: honor expired CEL PolicyExceptions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16299](https://github.com/kyverno/kyverno/pull/16299) - fix(background): scan NamespacedImageValidatingPolicy resources too by [@&#8203;Proximyst](https://github.com/Proximyst) in [#&#8203;16301](https://github.com/kyverno/kyverno/pull/16301) - fix: validate stdin across apply paths by [@&#8203;karthikmanam](https://github.com/karthikmanam) in [#&#8203;16347](https://github.com/kyverno/kyverno/pull/16347) - feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by [@&#8203;SargamPuram](https://github.com/SargamPuram) in [#&#8203;16297](https://github.com/kyverno/kyverno/pull/16297) - fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16291](https://github.com/kyverno/kyverno/pull/16291) - chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16371](https://github.com/kyverno/kyverno/pull/16371) - fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by [@&#8203;aditip149209](https://github.com/aditip149209) in [#&#8203;16361](https://github.com/kyverno/kyverno/pull/16361) - fix(deps): upgrade ristretto to v2 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16360](https://github.com/kyverno/kyverno/pull/16360) - fix: unblock ko image publish by replacing escaping kodata symlinks by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16381](https://github.com/kyverno/kyverno/pull/16381) - chore(workflow): dynamically discover active branches for Trivy issue sync by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16377](https://github.com/kyverno/kyverno/pull/16377) - fix CEL autogen namespace replacement by [@&#8203;dag-andersen](https://github.com/dag-andersen) in [#&#8203;16039](https://github.com/kyverno/kyverno/pull/16039) - fix(gpol): support mixed-type aggregate literals in CEL variables by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16339](https://github.com/kyverno/kyverno/pull/16339) - docs: fix README workflow badge and AI policy link by [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) in [#&#8203;16162](https://github.com/kyverno/kyverno/pull/16162) - fix(deps): bump rekor and in-toto-golang for codeql alerts by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16394](https://github.com/kyverno/kyverno/pull/16394) - test: fix webhook registration typo by [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) in [#&#8203;16164](https://github.com/kyverno/kyverno/pull/16164) - feat: support skipBackgroundRequests for CEL mpol/gpol by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16369](https://github.com/kyverno/kyverno/pull/16369) - test(chainsaw): fix NIVP background + clone-multiple-targets setup by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16399](https://github.com/kyverno/kyverno/pull/16399) - chore: update pond dependency to v2 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16379](https://github.com/kyverno/kyverno/pull/16379) - chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16402](https://github.com/kyverno/kyverno/pull/16402) - Update backoff v7 by [@&#8203;khiemdoan](https://github.com/khiemdoan) in [#&#8203;16405](https://github.com/kyverno/kyverno/pull/16405) - Don't initialize rekor client for key or certificate based scenarios by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16415](https://github.com/kyverno/kyverno/pull/16415) - chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15939](https://github.com/kyverno/kyverno/pull/15939) - test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16414](https://github.com/kyverno/kyverno/pull/16414) - chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;15991](https://github.com/kyverno/kyverno/pull/15991) - chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16420](https://github.com/kyverno/kyverno/pull/16420) - test(integration): add YAML fixture loaders for the framework by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16229](https://github.com/kyverno/kyverno/pull/16229) - fix: preserve cluster-scoped generated resources by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16362](https://github.com/kyverno/kyverno/pull/16362) - fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16426](https://github.com/kyverno/kyverno/pull/16426) - feat(gpol): support useServerSideApply for GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16403](https://github.com/kyverno/kyverno/pull/16403) - fix(api): use allPath instead of anyPath in m.All validation loop by [@&#8203;Utkal059](https://github.com/Utkal059) in [#&#8203;16296](https://github.com/kyverno/kyverno/pull/16296) - fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes [#&#8203;16256](https://github.com/kyverno/kyverno/issues/16256) by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16258](https://github.com/kyverno/kyverno/pull/16258) - fix(ci): use server-side apply for conformance CRD refresh by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16429](https://github.com/kyverno/kyverno/pull/16429) - fix: add sorting for ivpol targets by [@&#8203;1vanden](https://github.com/1vanden) in [#&#8203;16252](https://github.com/kyverno/kyverno/pull/16252) - fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by [@&#8203;InsomniaCoder](https://github.com/InsomniaCoder) in [#&#8203;15865](https://github.com/kyverno/kyverno/pull/15865) - fix(ci): force conflicts when server-side applying conformance CRDs by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16432](https://github.com/kyverno/kyverno/pull/16432) - fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by [@&#8203;sandert-k8s](https://github.com/sandert-k8s) in [#&#8203;16255](https://github.com/kyverno/kyverno/pull/16255) - fix(reports): correct label prefix for mpol/dpol policies by [@&#8203;atharrva01](https://github.com/atharrva01) in [#&#8203;16452](https://github.com/kyverno/kyverno/pull/16452) - fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by [@&#8203;hugolevino](https://github.com/hugolevino) in [#&#8203;16298](https://github.com/kyverno/kyverno/pull/16298) - fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16287](https://github.com/kyverno/kyverno/pull/16287) - chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16442](https://github.com/kyverno/kyverno/pull/16442) - chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16441](https://github.com/kyverno/kyverno/pull/16441) - fix: resolve context leak in dynamic resource watcher by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16087](https://github.com/kyverno/kyverno/pull/16087) - feat(gpol): add auditAnnotations support to GeneratingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16505](https://github.com/kyverno/kyverno/pull/16505) - fix: add policies.kyverno.io resources to aggregate policy roles by [@&#8203;volantebjb](https://github.com/volantebjb) in [#&#8203;16239](https://github.com/kyverno/kyverno/pull/16239) - fix: address open CodeQL security vulnerabilities by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16528](https://github.com/kyverno/kyverno/pull/16528) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16516](https://github.com/kyverno/kyverno/pull/16516) - chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16515](https://github.com/kyverno/kyverno/pull/16515) - Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16511](https://github.com/kyverno/kyverno/pull/16511) - fix: skip reports RBAC check when background scanning is disabled by [@&#8203;p-fruck](https://github.com/p-fruck) in [#&#8203;16490](https://github.com/kyverno/kyverno/pull/16490) - fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by [@&#8203;rootp1](https://github.com/rootp1) in [#&#8203;16544](https://github.com/kyverno/kyverno/pull/16544) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16010](https://github.com/kyverno/kyverno/pull/16010) - chore(deps): bump the otel group across 1 directory with 4 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16539](https://github.com/kyverno/kyverno/pull/16539) - chore(deps): bump Homebrew/actions/limit-pull-requests from [`9ceb793`](https://github.com/kyverno/kyverno/commit/9ceb7934560eb61d131dde205a6c2d77b2e1529d) to [`18fcb8e`](https://github.com/kyverno/kyverno/commit/18fcb8e3e06b4247c676c506750dc95ea7226479) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16562](https://github.com/kyverno/kyverno/pull/16562) - Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16572](https://github.com/kyverno/kyverno/pull/16572) - fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by [@&#8203;Karthikk-18](https://github.com/Karthikk-18) in [#&#8203;16525](https://github.com/kyverno/kyverno/pull/16525) - chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16573](https://github.com/kyverno/kyverno/pull/16573) - chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16575](https://github.com/kyverno/kyverno/pull/16575) - fix(chart): wire cleanup controller core extra resources by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16165](https://github.com/kyverno/kyverno/pull/16165) - fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16561](https://github.com/kyverno/kyverno/pull/16561) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16574](https://github.com/kyverno/kyverno/pull/16574) - fix: avoid mutating policy webhook name collisions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16578](https://github.com/kyverno/kyverno/pull/16578) - fix: add missing reportProperties to v2beta1 Rule by [@&#8203;zyzzmohit](https://github.com/zyzzmohit) in [#&#8203;15564](https://github.com/kyverno/kyverno/pull/15564) - test(integration): single-pass report aggregation helper + flagship test by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16244](https://github.com/kyverno/kyverno/pull/16244) - ci: add Semgrep SAST workflow by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16464](https://github.com/kyverno/kyverno/pull/16464) - fix(helm): handle null image tags in \_image.tpl and fix reports-server defaultTag by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16063](https://github.com/kyverno/kyverno/pull/16063) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16576](https://github.com/kyverno/kyverno/pull/16576) - fix: key generate test clone sources by policy by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16450](https://github.com/kyverno/kyverno/pull/16450) - Fix: require --resource for migrate command by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16471](https://github.com/kyverno/kyverno/pull/16471) - fix(admissionpolicy): default userInfo groups and uid during background scans by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16592](https://github.com/kyverno/kyverno/pull/16592) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16598](https://github.com/kyverno/kyverno/pull/16598) - fix: handle whitespace in mpol autogen Object constructor by [@&#8203;santhil-cyber](https://github.com/santhil-cyber) in [#&#8203;16292](https://github.com/kyverno/kyverno/pull/16292) - chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16599](https://github.com/kyverno/kyverno/pull/16599) - chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16600](https://github.com/kyverno/kyverno/pull/16600) - fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16588](https://github.com/kyverno/kyverno/pull/16588) - fix(mpol): handle DELETE target expression using oldObject by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16610](https://github.com/kyverno/kyverno/pull/16610) - fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16611](https://github.com/kyverno/kyverno/pull/16611) - fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by [@&#8203;Goutham-Annem](https://github.com/Goutham-Annem) in [#&#8203;16630](https://github.com/kyverno/kyverno/pull/16630) - fix: add subtests and fix typo in ext/wildcard/match\_test.go by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16625](https://github.com/kyverno/kyverno/pull/16625) - fix: resolve error shadowing in SplitDocuments signature by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16632](https://github.com/kyverno/kyverno/pull/16632) - fix: CustomNamespaceLister.List honors the label selector by [@&#8203;7se7en72025](https://github.com/7se7en72025) in [#&#8203;16628](https://github.com/kyverno/kyverno/pull/16628) - chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16621](https://github.com/kyverno/kyverno/pull/16621) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16619](https://github.com/kyverno/kyverno/pull/16619) - ci: migrate pr-branch-updater to GitHub App auth by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16662](https://github.com/kyverno/kyverno/pull/16662) - chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16620](https://github.com/kyverno/kyverno/pull/16620) - fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16509](https://github.com/kyverno/kyverno/pull/16509) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16669](https://github.com/kyverno/kyverno/pull/16669) - chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16670](https://github.com/kyverno/kyverno/pull/16670) - refactor: add context propagation to background util functions by [@&#8203;farhan11166](https://github.com/farhan11166) in [#&#8203;16643](https://github.com/kyverno/kyverno/pull/16643) - cleanup: remove dead fakeContext code by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16675](https://github.com/kyverno/kyverno/pull/16675) - feat: support MutatingPolicy target conditions and subresource targets by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16614](https://github.com/kyverno/kyverno/pull/16614) - fix(webhook): scope namespaced policies to their own namespace by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16615](https://github.com/kyverno/kyverno/pull/16615) - chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16684](https://github.com/kyverno/kyverno/pull/16684) - chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16681](https://github.com/kyverno/kyverno/pull/16681) - chore: bump controller-tools by [@&#8203;eddycharly](https://github.com/eddycharly) in [#&#8203;16687](https://github.com/kyverno/kyverno/pull/16687) - fix: make file extension checks case-insensitive by [@&#8203;Iqrima](https://github.com/Iqrima) in [#&#8203;16689](https://github.com/kyverno/kyverno/pull/16689) - chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16668](https://github.com/kyverno/kyverno/pull/16668) - fix(ivpol): add debug logging for CEL image verification functions by [@&#8203;amarkdotdev](https://github.com/amarkdotdev) in [#&#8203;16305](https://github.com/kyverno/kyverno/pull/16305) - test: point ivpol cosign tests at the kyverno test-images registry by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16695](https://github.com/kyverno/kyverno/pull/16695) - feat: reuse image verification cache for ImageValidatingPolicy by [@&#8203;bhuvan-somisetty](https://github.com/bhuvan-somisetty) in [#&#8203;16694](https://github.com/kyverno/kyverno/pull/16694) - fix: enforce MutatingPolicy evaluation mode semantics by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16686](https://github.com/kyverno/kyverno/pull/16686) - ci: assign release milestone to PRs automatically at release time by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16661](https://github.com/kyverno/kyverno/pull/16661) - chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16679](https://github.com/kyverno/kyverno/pull/16679) - chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16680](https://github.com/kyverno/kyverno/pull/16680) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16697](https://github.com/kyverno/kyverno/pull/16697) - fix: validate MAP-incompatible MutatingPolicy match conditions by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16698](https://github.com/kyverno/kyverno/pull/16698) - fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16594](https://github.com/kyverno/kyverno/pull/16594) - fix(generate): reject stale trigger UIDs when live resource does not match by [@&#8203;ANAMASGARD](https://github.com/ANAMASGARD) in [#&#8203;16603](https://github.com/kyverno/kyverno/pull/16603) - Image verification credential handling refactor by [@&#8203;aerosouund](https://github.com/aerosouund) in [#&#8203;16439](https://github.com/kyverno/kyverno/pull/16439) - fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16666](https://github.com/kyverno/kyverno/pull/16666) - feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16699](https://github.com/kyverno/kyverno/pull/16699) - feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16703](https://github.com/kyverno/kyverno/pull/16703) - fix: strip cross-namespace ownerReferences in CEL-based generation by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16716](https://github.com/kyverno/kyverno/pull/16716) - Fix DeletingPolicy objectSelector test results by [@&#8203;Prachidg](https://github.com/Prachidg) in [#&#8203;16431](https://github.com/kyverno/kyverno/pull/16431) - feat(cel): add regex.replace extension function by [@&#8203;tendinginfinity24](https://github.com/tendinginfinity24) in [#&#8203;16438](https://github.com/kyverno/kyverno/pull/16438) - fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16727](https://github.com/kyverno/kyverno/pull/16727) - fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16663](https://github.com/kyverno/kyverno/pull/16663) - fix(verification): use sigstore-go TUF client and fallback to trusted\_root.json by [@&#8203;rseleven](https://github.com/rseleven) in [#&#8203;16591](https://github.com/kyverno/kyverno/pull/16591) - fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16731](https://github.com/kyverno/kyverno/pull/16731) - test(integration): add ImageValidatingPolicy support to the framework by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16730](https://github.com/kyverno/kyverno/pull/16730) - feat(mpol): add auditAnnotations support to MutatingPolicy by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16721](https://github.com/kyverno/kyverno/pull/16721) - fix: preserve namespaceSelector during policy autogen by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16476](https://github.com/kyverno/kyverno/pull/16476) - fix: align policy metrics for new policy formats by [@&#8203;aditip149209](https://github.com/aditip149209) in [#&#8203;16359](https://github.com/kyverno/kyverno/pull/16359) - fix: validate DeletingPolicy cron schedule at admission by [@&#8203;Jayashanker-Padishala](https://github.com/Jayashanker-Padishala) in [#&#8203;16728](https://github.com/kyverno/kyverno/pull/16728) - \[Feature] add optional cache bounds via --maxGlobalContextEntries by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16560](https://github.com/kyverno/kyverno/pull/16560) - fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16397](https://github.com/kyverno/kyverno/pull/16397) - fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16434](https://github.com/kyverno/kyverno/pull/16434) - fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16739](https://github.com/kyverno/kyverno/pull/16739) - fix(helm): use request.namespace for vpolExclude matchConditions by [@&#8203;swastikCommits](https://github.com/swastikCommits) in [#&#8203;16751](https://github.com/kyverno/kyverno/pull/16751) - test(integration): align ivpol framework tests with single-phase image verification by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16741](https://github.com/kyverno/kyverno/pull/16741) - feat(helm): expose maxGlobalContextEntries in the Kyverno chart by [@&#8203;IceCodeBear](https://github.com/IceCodeBear) in [#&#8203;16749](https://github.com/kyverno/kyverno/pull/16749) - chore(deps): bump github.com/prometheus/client\_golang from 1.23.2 to 1.24.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16770](https://github.com/kyverno/kyverno/pull/16770) - chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16767](https://github.com/kyverno/kyverno/pull/16767) - chore(deps): bump the kubernetes group across 3 directories with 7 updates by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16737](https://github.com/kyverno/kyverno/pull/16737) - chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16738](https://github.com/kyverno/kyverno/pull/16738) - restrict issue self-assignment to good first issues for non-members by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16776](https://github.com/kyverno/kyverno/pull/16776) - chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16735](https://github.com/kyverno/kyverno/pull/16735) - chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16733](https://github.com/kyverno/kyverno/pull/16733) - chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16734](https://github.com/kyverno/kyverno/pull/16734) - fix: resolve namespaceObject with live API fallback on informer cache miss by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16784](https://github.com/kyverno/kyverno/pull/16784) - fix(cli): evaluate mutateExisting mutating policies on admission in test by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16618](https://github.com/kyverno/kyverno/pull/16618) - feat(cli): support admission operation simulation for policy testing by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16787](https://github.com/kyverno/kyverno/pull/16787) - fix: honor full-exemption PolicyException when multiple exceptions match by [@&#8203;AftAb-25](https://github.com/AftAb-25) in [#&#8203;16060](https://github.com/kyverno/kyverno/pull/16060) - fix: allow pod-level seccomp in restrict-seccomp-strict vpol by [@&#8203;Suhani95](https://github.com/Suhani95) in [#&#8203;16249](https://github.com/kyverno/kyverno/pull/16249) - fix(engine): honor per-rule failureAction in the admission block deci… by [@&#8203;rx18-eng](https://github.com/rx18-eng) in [#&#8203;16558](https://github.com/kyverno/kyverno/pull/16558) - Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by [@&#8203;kubeagon](https://github.com/kubeagon) in [#&#8203;15873](https://github.com/kyverno/kyverno/pull/15873) - fix(helm): disable in-process cert controller when cert-manager delegation is enabled by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16804](https://github.com/kyverno/kyverno/pull/16804) - Fix image verification parity gaps by [@&#8203;JimBugwadia](https://github.com/JimBugwadia) in [#&#8203;16800](https://github.com/kyverno/kyverno/pull/16800) - chore(deps): bump github.com/aptible/supercronic from 0.2.47 to 0.2.48 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16802](https://github.com/kyverno/kyverno/pull/16802) - fix: IVPOL mutateDigest unimplemented stub by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;16815](https://github.com/kyverno/kyverno/pull/16815) - chore(deps): bump docker/login-action from 4.5.1 to 4.5.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16818](https://github.com/kyverno/kyverno/pull/16818) - fix: enforce verifyDigest in ImageValidatingPolicy evaluator by [@&#8203;pyd-07](https://github.com/pyd-07) in [#&#8203;16817](https://github.com/kyverno/kyverno/pull/16817) - chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16837](https://github.com/kyverno/kyverno/pull/16837) - chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.20.1 to 2026.07.29.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16836](https://github.com/kyverno/kyverno/pull/16836) - chore(deps): bump docker/login-action from 4.5.2 to 4.6.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16834](https://github.com/kyverno/kyverno/pull/16834) - fix: sync GeneratingPolicy downstream in-place on trigger update and delete on no-longer-matching trigger by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16838](https://github.com/kyverno/kyverno/pull/16838) - fix: prevent autogen from rewriting namespaceObject in mpol by [@&#8203;lucchmielowski](https://github.com/lucchmielowski) in [#&#8203;15947](https://github.com/kyverno/kyverno/pull/15947) - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16835](https://github.com/kyverno/kyverno/pull/16835) - fix: bump cel-go to v0.30.0 to resolve CVE-2026-GHSA-gcjh-h69q-9w9g by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16782](https://github.com/kyverno/kyverno/pull/16782) - fix: evaluate resource filters from background scanning jobs by [@&#8203;sagarkhandagre998](https://github.com/sagarkhandagre998) in [#&#8203;16469](https://github.com/kyverno/kyverno/pull/16469) - feat: surface deprecation of legacy kyverno.io policy types (warnings, helm notice, PSS default) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16868](https://github.com/kyverno/kyverno/pull/16868) - feat: remove kyverno-json support from api by [@&#8203;eddycharly](https://github.com/eddycharly) in [#&#8203;16792](https://github.com/kyverno/kyverno/pull/16792) - fix(dclient): use RESTMapper for GVK to GVR mapping by [@&#8203;FirePheonix](https://github.com/FirePheonix) in [#&#8203;16905](https://github.com/kyverno/kyverno/pull/16905) - Fix context propagation in MatchPolicyContext by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16910](https://github.com/kyverno/kyverno/pull/16910) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16913](https://github.com/kyverno/kyverno/pull/16913) - \[Bug Fix] Fix data race and goroutine leak in policy\_spec fuzzing on get bytes error by [@&#8203;itsvishalyadav](https://github.com/itsvishalyadav) in [#&#8203;16908](https://github.com/kyverno/kyverno/pull/16908) - chore(deps): Upgrade gotest.tools to v3 by [@&#8203;chimanjain](https://github.com/chimanjain) in [#&#8203;16915](https://github.com/kyverno/kyverno/pull/16915) - chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.11 to 1.2.12 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16914](https://github.com/kyverno/kyverno/pull/16914) - chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;16912](https://github.com/kyverno/kyverno/pull/16912) - chore: cut release v1.19.0-rc.1 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;16922](https://github.com/kyverno/kyverno/pull/16922) - feat: remove kyverno-json from test api (Cherry-pick [#&#8203;16929](https://github.com/kyverno/kyverno/issues/16929)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16971](https://github.com/kyverno/kyverno/pull/16971) - feat: remove chainsaw tests using kyverno-json (Cherry-pick [#&#8203;16963](https://github.com/kyverno/kyverno/issues/16963)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16972](https://github.com/kyverno/kyverno/pull/16972) - feat: remove json scan command (Cherry-pick [#&#8203;16943](https://github.com/kyverno/kyverno/issues/16943)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16973](https://github.com/kyverno/kyverno/pull/16973) - fix: IVPOL required has no effect (Cherry-pick [#&#8203;16853](https://github.com/kyverno/kyverno/issues/16853)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;16987](https://github.com/kyverno/kyverno/pull/16987) - fix(policy): preserve validation warnings for generate rules in validateAction (Cherry-pick [#&#8203;16821](https://github.com/kyverno/kyverno/issues/16821)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17012](https://github.com/kyverno/kyverno/pull/17012) - feat(helm): add configurable lifecycle hooks to all controllers (Cherry-pick [#&#8203;16444](https://github.com/kyverno/kyverno/issues/16444)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17011](https://github.com/kyverno/kyverno/pull/17011) - fix(validation): reject non-string values in request.operation conditions (Cherry-pick [#&#8203;16977](https://github.com/kyverno/kyverno/issues/16977)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17013](https://github.com/kyverno/kyverno/pull/17013) - feat: remove reference to kyverno-json from go modules (cherry-pick [#&#8203;17005](https://github.com/kyverno/kyverno/issues/17005)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17010](https://github.com/kyverno/kyverno/pull/17010) - Fix goroutine and ticker leak in metrics initialization (Cherry-pick [#&#8203;17024](https://github.com/kyverno/kyverno/issues/17024)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17025](https://github.com/kyverno/kyverno/pull/17025) - Fix ticker leak in policyController background reconciliation loop (Cherry-pick [#&#8203;17027](https://github.com/kyverno/kyverno/issues/17027)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17030](https://github.com/kyverno/kyverno/pull/17030) - Fix context leak in TTL controller reconcile loop (Cherry-pick [#&#8203;17032](https://github.com/kyverno/kyverno/issues/17032)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17034](https://github.com/kyverno/kyverno/pull/17034) - Fix resource leak in sigstore fetchReferrers loop (Cherry-pick [#&#8203;17039](https://github.com/kyverno/kyverno/issues/17039)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17042](https://github.com/kyverno/kyverno/pull/17042) - fix(gpol): scope SyncWatchers stale downstream deletion to the evaluated trigger (Cherry-pick [#&#8203;17020](https://github.com/kyverno/kyverno/issues/17020)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17048](https://github.com/kyverno/kyverno/pull/17048) - fix(gpol): mark UpdateRequest as Failed when engine evaluation returns an error result (Cherry-pick [#&#8203;17061](https://github.com/kyverno/kyverno/issues/17061)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17064](https://github.com/kyverno/kyverno/pull/17064) - fix(webhook): do not offload namespaceObject match conditions to the API server (Cherry-pick [#&#8203;17069](https://github.com/kyverno/kyverno/issues/17069)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17072](https://github.com/kyverno/kyverno/pull/17072) - chore: cut release v1.19.0-rc.2 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17073](https://github.com/kyverno/kyverno/pull/17073) - Fix ignored context in notary registry resolution (Cherry-pick [#&#8203;17078](https://github.com/kyverno/kyverno/issues/17078)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17079](https://github.com/kyverno/kyverno/pull/17079) - fix(webhooks): handle nil RequestKind and RequestResource in trace middleware (Cherry-pick [#&#8203;17087](https://github.com/kyverno/kyverno/issues/17087)) by [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#&#8203;17091](https://github.com/kyverno/kyverno/pull/17091) - ci: add configurable code freeze check by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17095](https://github.com/kyverno/kyverno/pull/17095) - chore: cut release v1.19.0-rc.3 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17094](https://github.com/kyverno/kyverno/pull/17094) - fix(imageverify): repopulate intoto payload on attestation cache hit ([#&#8203;17117](https://github.com/kyverno/kyverno/issues/17117)) by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17195](https://github.com/kyverno/kyverno/pull/17195) - Release 1.19.0-rc.4 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17209](https://github.com/kyverno/kyverno/pull/17209) - chore: cut release v1.19.0 by [@&#8203;realshuting](https://github.com/realshuting) in [#&#8203;17238](https://github.com/kyverno/kyverno/pull/17238) #### New Contributors - [@&#8203;pulkitvats2007-crypto](https://github.com/pulkitvats2007-crypto) made their first contribution in [#&#8203;15827](https://github.com/kyverno/kyverno/pull/15827) - [@&#8203;williamclot](https://github.com/williamclot) made their first contribution in [#&#8203;15754](https://github.com/kyverno/kyverno/pull/15754) - [@&#8203;mastersans](https://github.com/mastersans) made their first contribution in [#&#8203;16181](https://github.com/kyverno/kyverno/pull/16181) - [@&#8203;the-technat](https://github.com/the-technat) made their first contribution in [#&#8203;16161](https://github.com/kyverno/kyverno/pull/16161) - [@&#8203;naseyro](https://github.com/naseyro) made their first contribution in [#&#8203;16207](https://github.com/kyverno/kyverno/pull/16207) - [@&#8203;s3onghyun](https://github.com/s3onghyun) made their first contribution in [#&#8203;16279](https://github.com/kyverno/kyverno/pull/16279) - [@&#8203;7se7en72025](https://github.com/7se7en72025) made their first contribution in [#&#8203;16276](https://github.com/kyverno/kyverno/pull/16276) - [@&#8203;asiyani](https://github.com/asiyani) made their first contribution in [#&#8203;15824](https://github.com/kyverno/kyverno/pull/15824) - [@&#8203;senutpal](https://github.com/senutpal) made their first contribution in [#&#8203;16245](https://github.com/kyverno/kyverno/pull/16245) - [@&#8203;avoidik](https://github.com/avoidik) made their first contribution in [#&#8203;16280](https://github.com/kyverno/kyverno/pull/16280) - [@&#8203;Aneesh-Hegde](https://github.com/Aneesh-Hegde) made their first contribution in [#&#8203;16041](https://github.com/kyverno/kyverno/pull/16041) - [@&#8203;vmsilvamolina](https://github.com/vmsilvamolina) made their first contribution in [#&#8203;15872](https://github.com/kyverno/kyverno/pull/15872) - [@&#8203;Ebraam-Ashraf](https://github.com/Ebraam-Ashraf) made their first contribution in [#&#8203;16130](https://github.com/kyverno/kyverno/pull/16130) - [@&#8203;Proximyst](https://github.com/Proximyst) made their first contribution in [#&#8203;16301](https://github.com/kyverno/kyverno/pull/16301) - [@&#8203;dag-andersen](https://github.com/dag-andersen) made their first contribution in [#&#8203;16039](https://github.com/kyverno/kyverno/pull/16039) - [@&#8203;ObaidAbdullah16](https://github.com/ObaidAbdullah16) made their first contribution in [#&#8203;16162](https://github.com/kyverno/kyverno/pull/16162) - [@&#8203;khiemdoan](https://github.com/khiemdoan) made their first contribution in [#&#8203;16405](https://github.com/kyverno/kyverno/pull/16405) - [@&#8203;Utkal059](https://github.com/Utkal059) made their first contribution in [#&#8203;16296](https://github.com/kyverno/kyverno/pull/16296) - [@&#8203;pyd-07](https://github.com/pyd-07) made their first contribution in [#&#8203;16258](https://github.com/kyverno/kyverno/pull/16258) - [@&#8203;1vanden](https://github.com/1vanden) made their first contribution in [#&#8203;16252](https://github.com/kyverno/kyverno/pull/16252) - [@&#8203;InsomniaCoder](https://github.com/InsomniaCoder) made their first contribution in [#&#8203;15865](https://github.com/kyverno/kyverno/pull/15865) - [@&#8203;hugolevino](https://github.com/hugolevino) made their first contribution in [#&#8203;16298](https://github.com/kyverno/kyverno/pull/16298) - [@&#8203;AftAb-25](https://github.com/AftAb-25) made their first contribution in [#&#8203;16087](https://github.com/kyverno/kyverno/pull/16087) - [@&#8203;volantebjb](https://github.com/volantebjb) made their first contribution in [#&#8203;16239](https://github.com/kyverno/kyverno/pull/16239) - [@&#8203;p-fruck](https://github.com/p-fruck) made their first contribution in [#&#8203;16490](https://github.com/kyverno/kyverno/pull/16490) - [@&#8203;rootp1](https://github.com/rootp1) made their first contribution in [#&#8203;16544](https://github.com/kyverno/kyverno/pull/16544) - [@&#8203;Karthikk-18](https://github.com/Karthikk-18) made their first contribution in [#&#8203;16525](https://github.com/kyverno/kyverno/pull/16525) - [@&#8203;santhil-cyber](https://github.com/santhil-cyber) made their first contribution in [#&#8203;16292](https://github.com/kyverno/kyverno/pull/16292) - [@&#8203;Goutham-Annem](https://github.com/Goutham-Annem) made their first contribution in [#&#8203;16630](https://github.com/kyverno/kyverno/pull/16630) - [@&#8203;Iqrima](https://github.com/Iqrima) made their first contribution in [#&#8203;16625](https://github.com/kyverno/kyverno/pull/16625) - [@&#8203;farhan11166](https://github.com/farhan11166) made their first contribution in [#&#8203;16643](https://github.com/kyverno/kyverno/pull/16643) - [@&#8203;amarkdotdev](https://github.com/amarkdotdev) made their first contribution in [#&#8203;16305](https://github.com/kyverno/kyverno/pull/16305) - [@&#8203;bhuvan-somisetty](https://github.com/bhuvan-somisetty) made their first contribution in [#&#8203;16694](https://github.com/kyverno/kyverno/pull/16694) - [@&#8203;Prachidg](https://github.com/Prachidg) made their first contribution in [#&#8203;16431](https://github.com/kyverno/kyverno/pull/16431) - [@&#8203;tendinginfinity24](https://github.com/tendinginfinity24) made their first contribution in [#&#8203;16438](https://github.com/kyverno/kyverno/pull/16438) - [@&#8203;rseleven](https://github.com/rseleven) made their first contribution in [#&#8203;16591](https://github.com/kyverno/kyverno/pull/16591) - [@&#8203;Jayashanker-Padishala](https://github.com/Jayashanker-Padishala) made their first contribution in [#&#8203;16728](https://github.com/kyverno/kyverno/pull/16728) - [@&#8203;swastikCommits](https://github.com/swastikCommits) made their first contribution in [#&#8203;16751](https://github.com/kyverno/kyverno/pull/16751) - [@&#8203;kubeagon](https://github.com/kubeagon) made their first contribution in [#&#8203;15873](https://github.com/kyverno/kyverno/pull/15873) - [@&#8203;FirePheonix](https://github.com/FirePheonix) made their first contribution in [#&#8203;16905](https://github.com/kyverno/kyverno/pull/16905) - [@&#8203;kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] made their first contribution in [#&#8203;16971](https://github.com/kyverno/kyverno/pull/16971) **Full Changelog**: <https://github.com/kyverno/kyverno/compare/v1.18.2...v1.19.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44Ny4xIiwidXBkYXRlZEluVmVyIjoiNDQuMTA2LjAiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->

CSRBot added 1 commit 2026-09-15 14:12:30 +02:00

chore(deps): update dependency kyverno/kyverno to v1.19.1 32380f60ce

volker.raschek was assigned by CSRBot 2026-09-15 14:12:31 +02:00

CSRBot changed title from chore(deps): update dependency kyverno/kyverno to v1.19.1 to chore(deps): update dependency kyverno/kyverno to v1.19.1 - autoclosed 2026-09-28 09:06:41 +02:00

CSRBot closed this pull request 2026-09-28 09:06:42 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

CSRBot (CSRBot) volker.raschek (Markus Pesch)

No Assignees volker.raschek

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/kyverno-cli-bin-pkg#6