chore(deps): update dependency kyverno/kyverno to v1.19.2 #7

2026-10-21T03:04:52+02:00

CSRBot commented

2026-10-21 03:04:52 +02:00

This PR contains the following updates:

Package	Update	Change
kyverno/kyverno	patch	`1.19.1` → `1.19.2`

Release Notes

kyverno/kyverno (kyverno/kyverno)

`v1.19.2`

Compare Source

Security

Kyverno v1.19.2 addresses 24 published GitHub Security Advisories: 9 Critical, 14 High, and 1 Moderate. The fixes include:

Cherry-pick workflow script-injection hardening (Critical): GHSA-5gq8-3xxc-jm92 (#18014).
API path validation and namespace confinement (Critical): GHSA-3xfv-vq8x-qhg4, GHSA-pcx2-xcq4-65vf, GHSA-4pqm-wqq6-h9q2, GHSA-p58h-r4j3-h5vx, and GHSA-rcxg-3f92-3mgr (#17984, #18021).
NamespacedMutatingPolicy target confinement (Critical and High): GHSA-jcw5-3wcg-fqx5, GHSA-f96w-622v-rqpq, and GHSA-vm98-8c25-h274 (#17984, #18021).
PolicyException enforcement in generated admission policies (High): GHSA-qc9c-3fgf-cgq8 (#17987).
CEL evaluation cost limits (Moderate): GHSA-m8p2-qqmx-j53x (#17989).
Bounded wildcard matching, safer variable substitution, and panic prevention (High): GHSA-8mrj-27wr-599g, GHSA-338x-hgrv-626h, GHSA-r2p2-3892-5jjf, and GHSA-x4xq-p8g4-6fwg (#17991).
Image verification and attestation hardening (Critical and High): GHSA-h3pm-q9ww-f439, GHSA-fcfr-fr8g-qjqv, GHSA-24cc-9745-hxfc, GHSA-2r43-6962-xcw5, GHSA-3f2c-hfj8-542w, and GHSA-fr24-3hvf-393q (#17994, #17996).
Generate authorization, clone namespace confinement, and internal-label protections (High): GHSA-q62c-r9v2-cf64, GHSA-hg5v-hwm3-956r, and GHSA-493q-9xvg-9xf3 (#17937, #17938).

See the linked advisories for affected-version details. Upgrade to v1.19.2 to receive these fixes.

What's Changed

feat: Add filter field to imageExtractors for wildcard array filtering by @arewm in #16269
perf: reduce engine context checkpoint copy cost by @ANAMASGARD in #17565
ci: record failed job instances in workflow failure issues (Cherry-pick #16889) by @kyverno-pr-updater[bot] in #17587
perf(cel): build the request activation once per admission request (Cherry-pick #17572) by @kyverno-pr-updater[bot] in #17588
test(ci): CEL admission-path allocation-regression gate (post-merge) (Cherry-pick #17573) by @kyverno-pr-updater[bot] in #17589
fix(deleting): process namespaced resources with pagination (Cherry-pick #17263) by @kyverno-pr-updater[bot] in #17603
fix(webhook): avoid image validating policy webhook name collisions (Cherry-pick #17558) by @kyverno-pr-updater[bot] in #17617
fix: autogen fine-grained namespaced image policies (Cherry-pick #16840) by @kyverno-pr-updater[bot] in #17614
chore(deps): bump kyverno sdk version to the latest commit (Cherry-pick #17616) by @kyverno-pr-updater[bot] in #17619
fix(cli): resolve match constraints for namespaced validating policies (cherry-pick #17608) by @harshrajdebug in #17612
fix(webhook): enforce exceptionNamespace for CEL PolicyExceptions (Cherry-pick #17479) by @kyverno-pr-updater[bot] in #17651
fix: preserve MutatingPolicy reinvocation policy (Cherry-pick #17324) by @kyverno-pr-updater[bot] in #17745
feat(charts): support Pod user namespaces in PSS policies (Cherry-pick #17693) by @kyverno-pr-updater[bot] in #17746
fix(cli): preserve GeneratingPolicy skips in test results (Cherry-pick #17388) by @kyverno-pr-updater[bot] in #17749
fix(background): resolve generate triggers by name instead of listing the namespace (Cherry-pick #17702) by @kmehta-code in #17779
fix(mpol): evaluate matchConditions during background mutateExisting evaluation (Cherry-pick #17433) by @kyverno-pr-updater[bot] in #17782
fix: verify annotations properly for cosign v2 and v3 (Cherry-pick #17794) by @kyverno-pr-updater[bot] in #17798
feat: support additionalExtensions for keyless signing in the ivpol (Cherry-pick #17813) by @kyverno-pr-updater[bot] in #17814
test(cli): cover CRD-aware policy test mapping (Cherry-pick #17808) by @kyverno-pr-updater[bot] in #17816
perf(cel): hoist the request-map build in the ivpol engine (Cherry-pick #17585) by @raunak-nirmata in #17872
[release-1.19] fix(deps): bump go to 1.26.9 to fix CVE-2026-97031 by @rx18-eng in #17976
fix(imageverify): bound the reads image verification makes from a registry by @raunak-nirmata in #17996
fix(engine): bound wildcard matching and variable substitution by @raunak-nirmata in #17991
fix(imageverify): verify at admission instead of trusting prior-stage metadata by @raunak-nirmata in #17994
[1.19] fix(security): API path validation, apiCall canonicalization, mpol/cleanup namespace confinement by @Rohanraj123 in #17984
[1.19] fix(security): harden cherry-pick workflows against script injection by @JimBugwadia in #18014
fix(vap): apply the runtime PolicyException gates in the admission-policy generator by @raunak-nirmata in #17987
fix(cel): bound the cost of CEL policy expression evaluation by @raunak-nirmata in #17989
fix(security): cherry-pick N4K #1077 and #1164 (namespace clamp) to release-1.19 by @Rohanraj123 in #18021
fix: preserve controller-owned generation labels (#17938) by @aerosouund in #18033
fix(pss): support user namespace pods in validate.podSecurity by @Suhani95 in #17913
[release-1.19] fix(deps): update x/net for CVE-2026-97032 by @Sashang-debug in #18027
[release-1.19] fix(deps): update x/net for CVE-2026-78663 by @Sashang-debug in #18025
fix: repair the post-merge Tests workflow on main (#17761) by @aerosouund in #18035
test: expect the generation label protection webhook in chainsaw asserts by @aerosouund in #18039
[release-1.19] fix: preserve legacy generation scope and ownership by @sagark-nirmata in #17937
chore: pass GORELEASER_CURRENT_TAG to the goreleaser by @aerosouund in #18124
chore: bump chart to 3.9.2-rc.5 for v1.19.2-rc.5 by @aerosouund in #18132
chore: bump chart to 3.9.2 for v1.19.2 by @aerosouund in #18145

New Contributors

@arewm made their first contribution in #16269

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.19.1...v1.19.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kyverno/kyverno](https://github.com/kyverno/kyverno) | patch | `1.19.1` → `1.19.2` | --- ### Release Notes <details> <summary>kyverno/kyverno (kyverno/kyverno)</summary> ### [`v1.19.2`](https://github.com/kyverno/kyverno/releases/tag/v1.19.2) [Compare Source](https://github.com/kyverno/kyverno/compare/v1.19.1-rc.1...v1.19.2-rc.1) #### Security Kyverno v1.19.2 addresses 24 published GitHub Security Advisories: 9 Critical, 14 High, and 1 Moderate. The fixes include: - Cherry-pick workflow script-injection hardening (Critical): GHSA-5gq8-3xxc-jm92 ([#18014](https://github.com/kyverno/kyverno/issues/18014)). - API path validation and namespace confinement (Critical): GHSA-3xfv-vq8x-qhg4, GHSA-pcx2-xcq4-65vf, GHSA-4pqm-wqq6-h9q2, GHSA-p58h-r4j3-h5vx, and GHSA-rcxg-3f92-3mgr ([#17984](https://github.com/kyverno/kyverno/issues/17984), [#18021](https://github.com/kyverno/kyverno/issues/18021)). - NamespacedMutatingPolicy target confinement (Critical and High): GHSA-jcw5-3wcg-fqx5, GHSA-f96w-622v-rqpq, and GHSA-vm98-8c25-h274 ([#17984](https://github.com/kyverno/kyverno/issues/17984), [#18021](https://github.com/kyverno/kyverno/issues/18021)). - PolicyException enforcement in generated admission policies (High): GHSA-qc9c-3fgf-cgq8 ([#17987](https://github.com/kyverno/kyverno/issues/17987)). - CEL evaluation cost limits (Moderate): GHSA-m8p2-qqmx-j53x ([#17989](https://github.com/kyverno/kyverno/issues/17989)). - Bounded wildcard matching, safer variable substitution, and panic prevention (High): GHSA-8mrj-27wr-599g, GHSA-338x-hgrv-626h, GHSA-r2p2-3892-5jjf, and GHSA-x4xq-p8g4-6fwg ([#17991](https://github.com/kyverno/kyverno/issues/17991)). - Image verification and attestation hardening (Critical and High): GHSA-h3pm-q9ww-f439, GHSA-fcfr-fr8g-qjqv, GHSA-24cc-9745-hxfc, GHSA-2r43-6962-xcw5, GHSA-3f2c-hfj8-542w, and GHSA-fr24-3hvf-393q ([#17994](https://github.com/kyverno/kyverno/issues/17994), [#17996](https://github.com/kyverno/kyverno/issues/17996)). - Generate authorization, clone namespace confinement, and internal-label protections (High): GHSA-q62c-r9v2-cf64, GHSA-hg5v-hwm3-956r, and GHSA-493q-9xvg-9xf3 ([#17937](https://github.com/kyverno/kyverno/issues/17937), [#17938](https://github.com/kyverno/kyverno/issues/17938)). See the linked advisories for affected-version details. Upgrade to v1.19.2 to receive these fixes. #### What's Changed - feat: Add filter field to imageExtractors for wildcard array filtering by [@arewm](https://github.com/arewm) in [#16269](https://github.com/kyverno/kyverno/pull/16269) - perf: reduce engine context checkpoint copy cost by [@ANAMASGARD](https://github.com/ANAMASGARD) in [#17565](https://github.com/kyverno/kyverno/pull/17565) - ci: record failed job instances in workflow failure issues (Cherry-pick [#16889](https://github.com/kyverno/kyverno/issues/16889)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17587](https://github.com/kyverno/kyverno/pull/17587) - perf(cel): build the request activation once per admission request (Cherry-pick [#17572](https://github.com/kyverno/kyverno/issues/17572)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17588](https://github.com/kyverno/kyverno/pull/17588) - test(ci): CEL admission-path allocation-regression gate (post-merge) (Cherry-pick [#17573](https://github.com/kyverno/kyverno/issues/17573)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17589](https://github.com/kyverno/kyverno/pull/17589) - fix(deleting): process namespaced resources with pagination (Cherry-pick [#17263](https://github.com/kyverno/kyverno/issues/17263)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17603](https://github.com/kyverno/kyverno/pull/17603) - fix(webhook): avoid image validating policy webhook name collisions (Cherry-pick [#17558](https://github.com/kyverno/kyverno/issues/17558)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17617](https://github.com/kyverno/kyverno/pull/17617) - fix: autogen fine-grained namespaced image policies (Cherry-pick [#16840](https://github.com/kyverno/kyverno/issues/16840)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17614](https://github.com/kyverno/kyverno/pull/17614) - chore(deps): bump kyverno sdk version to the latest commit (Cherry-pick [#17616](https://github.com/kyverno/kyverno/issues/17616)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17619](https://github.com/kyverno/kyverno/pull/17619) - fix(cli): resolve match constraints for namespaced validating policies (cherry-pick [#17608](https://github.com/kyverno/kyverno/issues/17608)) by [@harshrajdebug](https://github.com/harshrajdebug) in [#17612](https://github.com/kyverno/kyverno/pull/17612) - fix(webhook): enforce exceptionNamespace for CEL PolicyExceptions (Cherry-pick [#17479](https://github.com/kyverno/kyverno/issues/17479)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17651](https://github.com/kyverno/kyverno/pull/17651) - fix: preserve MutatingPolicy reinvocation policy (Cherry-pick [#17324](https://github.com/kyverno/kyverno/issues/17324)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17745](https://github.com/kyverno/kyverno/pull/17745) - feat(charts): support Pod user namespaces in PSS policies (Cherry-pick [#17693](https://github.com/kyverno/kyverno/issues/17693)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17746](https://github.com/kyverno/kyverno/pull/17746) - fix(cli): preserve GeneratingPolicy skips in test results (Cherry-pick [#17388](https://github.com/kyverno/kyverno/issues/17388)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17749](https://github.com/kyverno/kyverno/pull/17749) - fix(background): resolve generate triggers by name instead of listing the namespace (Cherry-pick [#17702](https://github.com/kyverno/kyverno/issues/17702)) by [@kmehta-code](https://github.com/kmehta-code) in [#17779](https://github.com/kyverno/kyverno/pull/17779) - fix(mpol): evaluate matchConditions during background mutateExisting evaluation (Cherry-pick [#17433](https://github.com/kyverno/kyverno/issues/17433)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17782](https://github.com/kyverno/kyverno/pull/17782) - fix: verify annotations properly for cosign v2 and v3 (Cherry-pick [#17794](https://github.com/kyverno/kyverno/issues/17794)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17798](https://github.com/kyverno/kyverno/pull/17798) - feat: support additionalExtensions for keyless signing in the ivpol (Cherry-pick [#17813](https://github.com/kyverno/kyverno/issues/17813)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17814](https://github.com/kyverno/kyverno/pull/17814) - test(cli): cover CRD-aware policy test mapping (Cherry-pick [#17808](https://github.com/kyverno/kyverno/issues/17808)) by [@kyverno-pr-updater](https://github.com/kyverno-pr-updater)\[bot] in [#17816](https://github.com/kyverno/kyverno/pull/17816) - perf(cel): hoist the request-map build in the ivpol engine (Cherry-pick [#17585](https://github.com/kyverno/kyverno/issues/17585)) by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17872](https://github.com/kyverno/kyverno/pull/17872) - \[release-1.19] fix(deps): bump go to 1.26.9 to fix CVE-2026-97031 by [@rx18-eng](https://github.com/rx18-eng) in [#17976](https://github.com/kyverno/kyverno/pull/17976) - fix(imageverify): bound the reads image verification makes from a registry by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17996](https://github.com/kyverno/kyverno/pull/17996) - fix(engine): bound wildcard matching and variable substitution by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17991](https://github.com/kyverno/kyverno/pull/17991) - fix(imageverify): verify at admission instead of trusting prior-stage metadata by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17994](https://github.com/kyverno/kyverno/pull/17994) - \[1.19] fix(security): API path validation, apiCall canonicalization, mpol/cleanup namespace confinement by [@Rohanraj123](https://github.com/Rohanraj123) in [#17984](https://github.com/kyverno/kyverno/pull/17984) - \[1.19] fix(security): harden cherry-pick workflows against script injection by [@JimBugwadia](https://github.com/JimBugwadia) in [#18014](https://github.com/kyverno/kyverno/pull/18014) - fix(vap): apply the runtime PolicyException gates in the admission-policy generator by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17987](https://github.com/kyverno/kyverno/pull/17987) - fix(cel): bound the cost of CEL policy expression evaluation by [@raunak-nirmata](https://github.com/raunak-nirmata) in [#17989](https://github.com/kyverno/kyverno/pull/17989) - fix(security): cherry-pick N4K [#1077](https://github.com/kyverno/kyverno/issues/1077) and [#1164](https://github.com/kyverno/kyverno/issues/1164) (namespace clamp) to release-1.19 by [@Rohanraj123](https://github.com/Rohanraj123) in [#18021](https://github.com/kyverno/kyverno/pull/18021) - fix: preserve controller-owned generation labels ([#17938](https://github.com/kyverno/kyverno/issues/17938)) by [@aerosouund](https://github.com/aerosouund) in [#18033](https://github.com/kyverno/kyverno/pull/18033) - fix(pss): support user namespace pods in validate.podSecurity by [@Suhani95](https://github.com/Suhani95) in [#17913](https://github.com/kyverno/kyverno/pull/17913) - \[release-1.19] fix(deps): update x/net for CVE-2026-97032 by [@Sashang-debug](https://github.com/Sashang-debug) in [#18027](https://github.com/kyverno/kyverno/pull/18027) - \[release-1.19] fix(deps): update x/net for CVE-2026-78663 by [@Sashang-debug](https://github.com/Sashang-debug) in [#18025](https://github.com/kyverno/kyverno/pull/18025) - fix: repair the post-merge Tests workflow on main ([#17761](https://github.com/kyverno/kyverno/issues/17761)) by [@aerosouund](https://github.com/aerosouund) in [#18035](https://github.com/kyverno/kyverno/pull/18035) - test: expect the generation label protection webhook in chainsaw asserts by [@aerosouund](https://github.com/aerosouund) in [#18039](https://github.com/kyverno/kyverno/pull/18039) - \[release-1.19] fix: preserve legacy generation scope and ownership by [@sagark-nirmata](https://github.com/sagark-nirmata) in [#17937](https://github.com/kyverno/kyverno/pull/17937) - chore: pass GORELEASER\_CURRENT\_TAG to the goreleaser by [@aerosouund](https://github.com/aerosouund) in [#18124](https://github.com/kyverno/kyverno/pull/18124) - chore: bump chart to 3.9.2-rc.5 for v1.19.2-rc.5 by [@aerosouund](https://github.com/aerosouund) in [#18132](https://github.com/kyverno/kyverno/pull/18132) - chore: bump chart to 3.9.2 for v1.19.2 by [@aerosouund](https://github.com/aerosouund) in [#18145](https://github.com/kyverno/kyverno/pull/18145) #### New Contributors - [@arewm](https://github.com/arewm) made their first contribution in [#16269](https://github.com/kyverno/kyverno/pull/16269) **Full Changelog**: <https://github.com/kyverno/kyverno/compare/v1.19.1...v1.19.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

CSRBot added 1 commit 2026-10-21 03:04:52 +02:00

chore(deps): update dependency kyverno/kyverno to v1.19.2 51572a0313

volker.raschek was assigned by CSRBot

2026-10-21 03:04:53 +02:00

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/kyverno-kyverno-1.x:renovate/kyverno-kyverno-1.x

git checkout renovate/kyverno-kyverno-1.x

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/kyverno-cli-bin-pkg#7