v1.19
Contains release notes of Nirmata Enterprise for Kyverno v1.19
The latest version of the 1.19 release of Enterprise Kyverno is v1.19.0-n4k.nirmata.2, released October 9, 2026.
Enterprise Kyverno 1.19 is built on upstream Kyverno 1.19 and supports Kubernetes 1.34 through 1.37. For the full support matrix, see Compatibility.
For a complete list of changes, refer to the upstream Changelog.
v1.19.0-n4k.nirmata.2 — October 9, 2026
| CVE | Component | Severity | Fix type | Image(s) affected | Notes |
|---|---|---|---|---|---|
| GHSA-2r43-6962-xcw5 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The image verification cache keyed a prior pass verdict on the image reference string, which could be a bare tag. Because a registry can repoint a tag, a verdict earned by one image could later be served for a different image pushed to the same tag. Fixed by refusing to store or serve any cache entry whose reference is not digest-pinned, and by resolving the digest before deriving the key. (Fix type is a code change; the CVE automation does not emit this entry. fixed/installed point at the next 1.19 n4k build, v1.19.0-n4k.nirmata.2, which carries the fix; there is no upstream-style 1.19.2 n4k tag.) |
| GHSA-3xfv-vq8x-qhg4 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A namespaced Policy apiCall validated the urlPath against the whole string, query and fragment included, but executed only the parsed path, so validation and execution disagreed on the target. A decoy /namespaces/ |
| GHSA-4pqm-wqq6-h9q2 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Namespaced CEL policy helpers (resource.get, resource.list, and resource.post) passed their resource, group, and version arguments to the Kubernetes dynamic client, which builds the request path by joining segments. The client validates the namespace and object name but not these arguments, so a ‘..’ or an embedded slash in the resource argument could redirect a request to another namespace or to a cluster-scoped path. Because this line ships namespaced CEL policies, a policy author confined to one namespace could reach objects in other namespaces or at cluster scope, served with the Kyverno controller’s permissions. Fixed by validating every path segment derived from a policy argument and rejecting empty, ‘.’, ‘..’, and slash- or backslash-injected segments before any request is issued. Commit 2e1bde1d85c8719c546c338d9585a36ff8d0be6b on release-1.19-n4k. |
| GHSA-5qq8-67g6-4h2w | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller, reports-controller | Percent-encoded dot-segments (%2e%2e) in a namespaced Policy apiCall urlPath bypassed the namespace clamp, letting a tenant POST cluster-scoped objects (for example MutatingWebhookConfigurations) as the Kyverno ServiceAccount and escalate to cluster admin; fixed by URL-decoding the path before normalizing and validating it (upstream 7ac176ac, on this branch as e58e1840d). (Shipped in v1.19.0-n4k.nirmata.1; record corrected from the bare upstream version to the n4k tag that carries it.) |
| GHSA-f96w-622v-rqpq | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller | A namespaced MutatingPolicy’s mutate-existing CEL target expression was trusted without confinement, so it could resolve targets in another namespace or cluster-scoped kinds. The fix reports the REST scope of each resolved target and rejects any target that is cluster scoped or outside the policy’s namespace before the resource is re-fetched or written. Enterprise commit 74aae2792b. |
| GHSA-jcw5-3wcg-fqx5 | github.com/kyverno/kyverno | Critical | Code change | kyverno, background-controller | A namespaced MutatingPolicy’s mutate-existing targets could redirect a write to a resource in another namespace by rewriting the mutated object’s identity. The fix rejects any patch whose namespace, kind, apiVersion, or name does not match the object it is meant to patch, and filters resource-rule targets by REST scope. Enterprise commit 74aae2792b. |
| GHSA-p58h-r4j3-h5vx | github.com/kyverno/kyverno | Critical | Code change | kyverno, cleanup-controller | The cleanup controller built its context loader without the policy’s own scope, so a namespaced CleanupPolicy’s context entries were treated as cluster scoped and were not confined to the policy’s namespace. The fix passes the real policy to the context loader factory, so a namespaced CleanupPolicy resolves apiCall and configMap context only within its own namespace, and rejects global references at both admission and runtime. Enterprise commits 3dd73bb431 and 74aae2792b on this branch. |
| GHSA-rcxg-3f92-3mgr | github.com/kyverno/kyverno | Critical | Code change | kyverno, cleanup-controller | A namespaced CleanupPolicy could issue apiCall context requests to paths outside its own namespace. The fix validates the apiCall path and confines it to the policy’s namespace, rejecting cross-namespace and cluster-scoped requests before they are sent. Cluster-scoped CleanupPolicy behavior is unchanged. Enterprise commits 3dd73bb431 and 74aae2792b on this branch. |
| GHSA-vjfx-fp68-rh4v | github.com/kyverno/kyverno | Critical | Code change | kyverno | Legacy namespaced generate rules allowed expressions to select resource types or namespaces before their scope could be established. Namespaced policies now require static scope-selecting fields while preserving dynamic resource names. Both variables and references are rejected in these fields, and live admission preserves fail-closed target authorization. This records the release-1.19-n4k code fix for the 1.19.2 security workstream; no patched enterprise tag or public release is asserted. Hold docs publication until advisory disclosure. Fixed by commit dc0785d45c01bca24ac60d142ac78e625832111f |
| CVE-2026-84304 | google.golang.org/grpc | High | Bump module version | background-controller, cleanup-controller, kubectl-kyverno, kyverno-init, kyverno, reports-controller | v1.83.0 → v1.83.1 |
| CVE-2026-84445 | google.golang.org/grpc | High | Bump module version | background-controller, cleanup-controller, kubectl-kyverno, kyverno-init, kyverno, reports-controller | v1.83.0 → 1.82.2 (scanner also listed: 1.83.2, 1.85.0-dev.0.20260825072537-93e31b48545e) |
| GHSA-24cc-9745-hxfc | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Unchecked type assertions on remote attestation and OCI manifest JSON panicked on a non-string type field, bypassing image verification and crash-looping the reports controller. Fixed by reading those fields through a checked accessor that returns an error, so malformed remote data fails closed. (Fix type is a code change; the CVE automation does not emit this entry. fixed/installed point at the next 1.19 n4k build, v1.19.0-n4k.nirmata.2, which carries the fix; there is no upstream-style 1.19.2 n4k tag.) |
| GHSA-2v4p-qf9q-27wj | google.golang.org/grpc | High | Bump module version | background-controller, cleanup-controller, kubectl-kyverno, kyverno-init, kyverno, reports-controller | v1.83.0 → v1.83.2 |
| GHSA-338x-hgrv-626h | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Variable substitution re-scanned already-substituted text, so nested or self-referential values could drive unbounded re-scanning. Fixed by bounding substitution to the author’s own template spans, with alias-hop and total-substitution limits. The substitution mitigation was completed on this line by two further changes: a per-document output-size cap that also accounts whole-leaf “{{ var }}” substitutions, and a rewrite that resolves each substitution pass in linear time, closing a worst case where a policy whose substituted output stayed under the size cap could still consume the admission webhook’s time budget. |
| GHSA-3f2c-hfj8-542w | github.com/kyverno/kyverno | High | Code change | kyverno, reports-controller | Notary attestation statement extraction checked the compressed descriptor and layer size against the 10 MB payload limit but read the decompressed predicate into memory without a bound, so an attacker-supplied referrer artifact that compresses small and expands large could exhaust admission controller memory; fixed by reading layers through a shared helper that decompresses under a bounded decoder and caps the decompressed output at the same limit (on this branch as 87cc5f94b). (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-493q-9xvg-9xf3 | github.com/kyverno/kyverno | High | Code change | background-controller | Namespaced legacy generate policies could access clone sources outside their namespace when evaluated without current admission checks. Runtime validation confines resolved clone and cloneList sources to namespaced kinds in the policy namespace, including foreach. This records the release-1.19-n4k code fix for the 1.19.2 security workstream; no patched enterprise tag or public release is asserted. Hold docs publication until advisory disclosure. Fixed by commit 3689c792f4f5699821de5850481bd185a4964fcf |
| GHSA-57hf-r692-6vrx | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Namespaced Policy globalReference access remains rejected at both admission and runtime. The shared context loader factory now also rejects nil policies and missing or malformed policy namespaces before initialization or entry loading, closing the empty-scope bypass (enterprise commits 9538456f5, 2c14ae686066517f994813166d36cc4252d005f8, and 65ba9a4b9a190372d1a9d2272544c236315435e3). Admission also rejects globalReference in recursive foreach and mutation-target contexts before warning-only returns or autogen filtering can skip a submitted rule (enterprise follow-up commit 436ad82a77429c4fe48b6195b1c45103af6d68d4). (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-59v6-2x73-wfg4 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller | The CEL globalcontext library was not namespace-confined, so a tenant-authored NamespacedPolicy could read cross-namespace GlobalContextEntry data; fixed by denying globalContext. in namespaced policies at admission and runtime (upstream #17377, release-1.19 backport #17455 backported to this branch in PR #944). (Shipped in v1.19.0-n4k.nirmata.1; record corrected from the bare upstream version to the n4k tag that carries it.) |
| GHSA-5cjf-wwfg-pj4c | github.com/kyverno/kyverno | High | Code change | kyverno, reports-controller | ImageValidatingPolicy ignored PolicyException.spec.images/allowedValues, so an exception meant for one image skipped signature verification for every image on a matched resource; fixed by refusing to treat a partial (image-scoped) exception as a full exemption (upstream #17307, on this branch as 9d19f4683). (Shipped in v1.19.0-n4k.nirmata.1; record corrected from the bare upstream version to the n4k tag that carries it.) |
| GHSA-68v8-7j3j-8995 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | CEL HTTP destination checks could treat alternate address encodings differently from their canonical destination. The release branch includes canonical embedded-address handling and CIDR-based metadata protection from the SDK and controller backports (47c83c601 and 3fdd28ede); the integrated CEL path now has explicit regression coverage for mapped, compatible, NAT64, and 6to4 forms (8b61e782a). Integrated regression PR: https://github.com/nirmata/enterprise-kyverno/pull/1147. (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-8mrj-27wr-599g | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The wildcard glob matcher used a recursive algorithm whose running time could grow exponentially with pattern length, so a crafted policy or resource string could stall policy evaluation. Fixed by replacing it with a linear two-pointer matcher bounded by a per-call work budget, plus length caps on wildcard fields at policy admission. |
| GHSA-c5qq-7g2q-cpqp | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller | The same %2e%2e path-traversal in namespaced Policy apiCall urlPath let a tenant read resources in other namespaces with the Kyverno ServiceAccount; fixed by the same URL-decode-before-clamp hardening (upstream 7ac176ac, on this branch as e58e1840d). (Shipped in v1.19.0-n4k.nirmata.1; record corrected from the bare upstream version to the n4k tag that carries it.) |
| GHSA-f5c5-qwxq-xg9r | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Namespaced Policy named and selector-based CEL parameter references default to and remain within the policy namespace, and cluster-scoped parameter kinds are rejected at admission and runtime. The shared exported collector now requires explicit policy scope and rejects missing or malformed scope before discovery or parameter reads, while preserving native Kubernetes VAP/MAP semantics (enterprise commits 2c14ae686066517f994813166d36cc4252d005f8 and 65ba9a4b9a190372d1a9d2272544c236315435e3). Admission now resolves the exact requested served API version and kind, rejects nonpreferred cluster-scoped versions, refreshes stale discovery once, and fails closed when scope cannot be resolved while allowing same-kind namespaced resources in distinct API groups (enterprise follow-up commit 436ad82a77429c4fe48b6195b1c45103af6d68d4). (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-fcfr-fr8g-qjqv | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | A cosign signing certificate with no subject alternative name caused the configured subject and subjectRegExp identity check to be skipped rather than failing, so a certificate carrying no identity satisfied a policy that pinned one. Fixed by failing closed when a subject constraint is configured and the certificate has no subject alternative name. (Fix type is a code change; the CVE automation does not emit this entry. fixed/installed point at the next 1.19 n4k build, v1.19.0-n4k.nirmata.2, which carries the fix; there is no upstream-style 1.19.2 n4k tag.) |
| GHSA-fr24-3hvf-393q | github.com/kyverno/kyverno | High | Code change | kyverno, reports-controller | Notary signature blob fetching applied the same compressed-only size check and buffered the decompressed signature layer without a bound, giving the same memory-exhaustion path during image verification; fixed by the same bounded-decoder helper, which also covers the equivalent cosign bundle read, and by rejecting a signature manifest that declares no layers instead of indexing it and panicking (on this branch as 87cc5f94b). (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-gghj-wcpm-cchr | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Policy-controlled registry and Sigstore HTTP destinations now share an egress guard that validates every resolved address, pins direct connections, revalidates redirects and pooled requests, and blocks metadata, loopback, link-local, unspecified, multicast, and broadcast destinations before network access or registry credential lookup. Audit mode is the patch-release default and still permits ordinary private networks; operators must select privateRegistryEgressMode=enforce to restrict those networks using exact host, IP, or CIDR entries in privateRegistryAllowlist. Exemptions never bypass hard blocks. Operator-configured proxies are validated separately and remain responsible for downstream DNS and egress controls. The guard covers registry token services, Rekor, CT log, TUF mirror/root, and public key URLs, with shared connection pools and context-bound DNS and dialing. Initial fix 8b61e782a; review hardening on this branch as 85c8d29e725b. Fix PR: https://github.com/nirmata/enterprise-kyverno/pull/1147. Follow-up verification on this branch as af68779f850701d04af6172b0e5440655735706c restores IVPOL operator key overrides and authenticated legacy/historical TUF trust, preserves aggregate-deadline fallback within an address family, and routes legacy validate.manifests registry, Rekor, and HTTP key/certificate loads through the same guard with digest-pinned image verification and full signature/certificate/bundle validation. KMS key references retain provider SDK networking. Registry flags are configured only on admission, background, and reports controllers; cleanup receives no unsupported registry flags. (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-gm4r-g7rh-3pjj | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | Namespace confinement now covers legacy Policy imageRegistry context and verifyImages credentials, NamespacedImageValidatingPolicy credentials, and static or dynamically supplied attestor signature pull secrets. Bare names resolve in the policy namespace; foreign references and missing or malformed policy scope fail closed at admission and runtime, before credential access or cached verification. Cluster-scoped behavior remains unchanged (enterprise commit 65ba9a4b9a190372d1a9d2272544c236315435e3). Admission now checks every submitted rule before warning-only returns and autogen filtering, including credentials in recursive foreach and mutation-target contexts (enterprise follow-up commit 436ad82a77429c4fe48b6195b1c45103af6d68d4). (fixed/installed corrected to the n4k build v1.19.0-n4k.nirmata.2 that carries the fix; there is no 1.19.2 n4k tag.) |
| GHSA-h3pm-q9ww-f439 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The validating webhook trusted the verify-images annotation written by the mutating webhook, so a request that set the annotation directly, or replayed it on UPDATE, was admitted without verification. Fixed by having the validating handler re-verify independently; the annotation is now informational only and is no longer read as a verdict. (Fix type is a code change; the CVE automation does not emit this entry. fixed/installed point at the next 1.19 n4k build, v1.19.0-n4k.nirmata.2, which carries the fix; there is no upstream-style 1.19.2 n4k tag.) |
| GHSA-hg5v-hwm3-956r | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller | Controller-issued HMAC provenance binds persisted target and policy UIDs to generation routing metadata. Non-trigger admission, clone-source traversal, policy reconciliation, and cleanup reject unsigned or forged candidates; queued requests retain policy identity and cleanup uses UID/resourceVersion preconditions. User-owned clone-source restores and standalone managed-by labels remain compatible. Preserve the installation key across upgrades; unsigned older downstreams require a trusted trigger event or explicit generateExisting re-evaluation. This records the unreleased release-1.19-n4k fix for the 1.19.2 security workstream; no patched enterprise tag or public release is asserted. Hold public docs until advisory disclosure. Fix PR: https://github.com/nirmata/enterprise-kyverno/pull/1087. Fixed by commit 30a4abd306e8772cd2a2c0c2b804eddacf743bf7 |
| GHSA-pcx2-xcq4-65vf | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | The same validate/execute divergence in a namespaced Policy apiCall urlPath let a query- or fragment-hidden decoy namespace segment pass the namespace clamp while the request read resources in a different namespace as the Kyverno ServiceAccount. Fixed by the same canonicalize-then-validate-the-path-only change and the anchored namespace clamp (on this branch as 7d26e61041 and bc530c724b). |
| GHSA-q62c-r9v2-cf64 | github.com/kyverno/kyverno | High | Code change | kyverno, cleanup-controller | Legacy generate and cleanup policy admission checked Kyverno controller permissions without independently authorizing the policy author for the selected targets. Admission now submits separate SubjectAccessReviews for the author, including groups, on creation and full-spec changes; unchanged specs retain existing validation without additional author permissions. Unresolved target API versions and kinds fail closed in live admission, variable namespaces require cluster-wide authorization, and every cloneList kind is checked. Empty author identities are rejected, and generate author checks run before warning returns. Offline CLI templates remain supported. This records the release-1.19-n4k code fix for the 1.19.2 security workstream; no patched enterprise tag or public release is asserted. Hold docs publication until advisory disclosure. Fixed by commit 7db8081ddc2b4d2d823ccc095a8a8a64d6478070 |
| GHSA-q825-p383-r9v5 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller | The legacy apiCall service executor and the GlobalContextEntry external-API path skipped the SSRF host/CIDR blocklist and sent the scoped ServiceAccount token to arbitrary hosts; fixed by wiring the egress blocklist, redirect checks, and token gating into that executor (upstream #17234/#17299/#17310, on this branch as e090f5287, 7c148f984, and 3fdd28ede). (Shipped in v1.19.0-n4k.nirmata.1; record corrected from the bare upstream version to the n4k tag that carries it.) |
| GHSA-qc9c-3fgf-cgq8 | github.com/kyverno/kyverno | High | Code change | kyverno | The admission-policy generator folded PolicyExceptions into generated ValidatingAdmissionPolicy and MutatingAdmissionPolicy resources without applying the gates runtime enforcement uses, so an exception the engine would reject still took effect in the generated native policy. The generator now applies the –enablePolicyException flag, –exceptionNamespace scoping, and policyRefs kind matching, delegating to the same helpers the CEL engines call. That initial fix left a same-class sink open, closed in v1.19.0-n4k.nirmata.2: the generator rendered an exception’s spec.images and spec.allowedValues into the generated policy’s CEL variable expressions by string concatenation, so a value containing a single quote escaped the string literal and became expression code — a crafted entry widened the allowed-image list to whatever image was under review. Both lists are now encoded as CEL literals instead of built as expression text (PR #1290). |
| GHSA-r2p2-3892-5jjf | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | An unchecked type assertion in the In and NotIn operators could panic on a non-string key element. Fixed by routing In-family comparison through a shared element primitive that handles non-string elements safely. |
| GHSA-vm98-8c25-h274 | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller | A namespaced MutatingPolicy’s mutate-existing resource-rule targets were not confined to the policy’s namespace, so the background controller could attempt writes outside it with its own service account. The fix decides target scope by REST mapping, skips non-namespaced kinds, lists a cluster-scoped kind at most once, and fails closed when a kind has no REST mapping. Enterprise commit 74aae2792b. |
| GHSA-vp52-pcj8-j9qc | google.golang.org/grpc | High | Bump module version | background-controller, cleanup-controller, kubectl-kyverno, kyverno-init, kyverno, reports-controller | v1.83.0 → v1.83.1 |
| GHSA-x4xq-p8g4-6fwg | github.com/kyverno/kyverno | High | Code change | kyverno, background-controller, reports-controller, cleanup-controller | An unchecked type assertion to string on a substituted or admission-supplied value could panic the engine or the policy-validation webhook. Fixed by guarding those assertions and degrading to an explicit error or a stringified fallback. |
| GO-2026-6354 | golang.org/x/crypto | High | Bump module version | kubectl-kyverno | v0.55.0 → v0.56.0 |
| GO-2026-6355 | golang.org/x/crypto | High | Bump module version | kubectl-kyverno | v0.55.0 → v0.56.0 |
| GHSA-m8p2-qqmx-j53x | github.com/kyverno/kyverno | Medium | Code change | kyverno, background-controller, reports-controller, cleanup-controller | CEL policy expressions were compiled without a cost limit, so the work one expression could do was unbounded and a policy author could exhaust a shared controller. Enabling cel-go’s cost limit alone does not help, because cel-go prices O(n) operations by resolved overload ID and Kyverno declares its resource variables as dyn, so every such call is billed a flat 1 unit; fixed by pricing calls by function name, refusing operations whose predicted output exceeds a size cap before they run, and metering the total cost of one request, all delivered as environment-level program options so every policy family and the legacy kyverno.io/v1 CEL path inherit them (PR #1028). That initial fix left three same-class vectors open, closed in v1.19.0-n4k.nirmata.2: lists.range allocated its whole result in one step before the post-hoc charge could bound it, now refused pre-execution by an element-count guard; a constant-pattern findAll bypassed its target-size guard because the apiserver’s regex optimizer rebuilt the call node after the guard wrapped it, now shadowed so the guarded node is kept; and size() on a large string was exempt from pricing despite its O(n) scan, now charged for the scan (PR #1238). |
Features
- Extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (#17014) (#17530) (#991)
- Add filter field to imageExtractors for wildcard array filtering (#16269) (#999)
- Add deprecation warning plumbing and legacy CRD version warnings (backport #17378, #17434) (#1001)
- Ship kyverno-notation-aws as a licensed subchart on release-1.19-n4k (#1330)
Fixes
- Restore Nirmata chart metadata lost in the main-oss rebase (#872)
- Handle missing reports CRDs as no-op in kyverno-init (#866)
- Infer Namespaced webhook scope for namespace-constrained wildcard policies (#860)
- Deny globalContext in namespaced policies (#17377) (#17455) (#944)
- Fix deadlocks in entry lifecycle and watch error handling (#16904) (#17454) (#979)
- Close layer readers per-iteration to avoid FD/memory leak (#16994) (#17498) (#980)
- Read PolicyExceptions from the manager cache, not a second informer (#16993) (#17464) (#981)
- Avoid race in evaluator image prefetch (#17313) (#17327) (#982)
- Fix label prefix and metadata for namespaced CEL policies (#17460) (#17480) (#984)
- Watch background-scan reports for the ephemeral reports circuit breaker (#17136) (#17430) (#987)
- Validate PolicyException CEL match conditions (#17350) (#17373) (#988)
- Skip namespace lookup in exception matching when no namespaceSelector is defined (#17140) (#17437) (#989)
- Propagate synchronize option to UpdateRequests (#16920) (#17446) (#986)
- Skip scalar values during wildcard image extraction (#16268) (#17521) (#992)
- Recreate downstream resource after repeated deletions (#17453) (#17520) (#990)
- Avoid redundant recorder notifications (#17059) (#17451) (#993)
- Discover autogen’d IVPol/NIVPol targets for background scan (#17395) (#17447) (#994)
- Avoid image validating policy webhook name collisions (#17558) (#17617) (#996)
- Autogen fine-grained namespaced image policies (backport #17614) (#998)
- Process namespaced resources with pagination (#17263) (#17603) (#995)
- Drop the obsolete reuse.yaml Go version check (#1007)
- Wait for CRDs to be established before dumping API groups (#1016)
- Free disk space before running codegen (#1020)
- Clamp context entries to a namespaced CleanupPolicy’s namespace (#1077)
- Apply runtime PolicyException gates in the admission-policy generator (#1006)
- Bound the cost of CEL policy expression evaluation (#1028)
- Bound memory when reading OCI layers (#1021)
- Harden the egress blocklist and anchor the namespace clamp (#1164)
- Bound the image config blob read (#1170)
- Close the remaining gaps in CEL expression cost accounting (#1181)
- Harden the image verification cache key and the deprecated attestor shorthands (#1192)
- Cap whole-leaf substitution output too (#1201)
- Detect cosign bundle format without downloading the bundle (#1213)
- Constrain namespaced generate clone sources (#1076)
- Decide cosign bundle format from bounded bundle content (#1217)
- Guard registry and Sigstore egress (#1147)
- Verify cosign bundles from the bounded referrer read (#1218)
- Authorize generate and cleanup policy targets (#1080)
- Confine namespaced policy credentials and parameters (#1148)
- Security/internal label provenance (#1087)
- Reject dynamic scope selectors in namespaced generate policies (#1088)
- Resolve each substitution pass in linear time (#1251)
- Honour an explicitly empty Authorization header (#1263)
- Encode exception image and value lists as CEL literals, not expression text (#1290)
- Bump reports-server, etcd, and kubectl to CVE-clean tags (#1335)
Additional changes
- Fix missing autogen webhook expansion for NamespacedValidatingPolicy (#17262) (#17273) (#985)
- Build the request activation once per admission request (#17572) (#17588) (#983)
- Reduce engine context checkpoint copy cost (#17565) (#997)
- Use server-side apply when installing CRDs for codegen (#1011)
- [security][1.19.2] apiCall URL canonicalization and namespace confinement (#1018)
- Harden image verification trust boundaries (#1010)
- Harden wildcard matching and variable substitution (#1012)
- Fix *NotIn null semantics and cap variable-substitution output (#1141)
- [security][1.19.2] CEL resource path segment validation (#1019)
- [security][1.19.2] Confine NamespacedMutatingPolicy targets by REST scope; deny globalReference in namespaced CleanupPolicy (#1041)
- [security][1.19.2] CEL cost model: bound lists.range, restore the findAll guard, charge size(), count split pieces (1.19) (#1238)
- [security][1.19.2] Configurable verification payload limit; bound the referrers index (#1262)