Kyverno v1.19.1
security++**************!!
Changes
- Bump Go 1.26.6 and x/net to resolve CVE-2026-39821security
- Update Go to address CVE-2026-56853security
- Cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c)security
- Phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pickadded
- Add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pickadded
- Extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pickadded
- Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pickfixed
- Apply HTTP blocklist to apiCall.service executor (cherry-pickfixed
- Harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pickfixed
- Avoid data race in image evaluator prefetch (Cherry-pickfixed
- Close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pickfixed
- Disable mutateDigest in exceptions-disabled IVPolfixed
19 more lines
- Loosen chainsaw stderr checks to containsfixed
- Disable IVPol digest defaults in leftover fixtures in v1.19fixed
- Backport 7ac176ac apiCall urlPath hardening to release-1.19fixed
- Validate PolicyException CEL match conditions (Cherry-pickfixed
- Disable IVPol digest defaults in leftover report fixturesfixed
- Watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pickfixed
- Handle missing reports CRDs as no-op in kyverno-init (Cherry-pickfixed
- Skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pickfixed
- Propagate synchronize option to UpdateRequests (Cherry-pickfixed
- Fix deadlocks in entry lifecycle and watch error handling (Cherry-pickfixed
- Avoid redundant recorder notifications (Cherry-pickfixed
- Fix label prefix and metadata for namespaced CEL policies (Cherry-pickfixed
- Close layer readers per-iteration to avoid FD/memory leak (Cherry-pickfixed
- Recreate downstream resource after repeated deletions (Cherry-pickfixed
- Skip scalar values during wildcard image extraction (Cherry-pickfixed
- Discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pickfixed
- [release-1.19] fix: deny globalContext in namespaced policiesother
- [release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informerother
- [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2other
4 maintenance lines (dependency bumps, CI, tests, docs)
- Bump kyverno sdk to 68d74afcb07amaintenance
- Bump golang.org/x/mod to v0.40.0maintenance
- Cut release v1.19.1-rc.1maintenance
- Cut release v1.19.1maintenance
35 lines3 security3 added22 fixed3 other4 maintenancetyped from the source notes