Kyverno v1.16.4
security******!!!!!!!!!!!!
Changes
- CVE-2025-68121 (Cherry-picksecurity
- CVE-2026-24051 (release 1.16)security
- Bump github.com/docker/cli to resolve CVE-2025-15558security
- CVE-2026-1229 in release-1.16security
- CVE-2026-26958security
- CVE-2025-15558security
- Bump sigstore/rekor to v1.5.1 to fix CVE-2026-23831security
- Bump go-tuf/v2 to v2.3.1 to address CVE-2026-23992security
- Resolve CVE-2025-66564security
- CVE-2026-33186security
- CVE-2026-22772security
- Bump go-tuf/v2 to v2.4.1 to patch CVE-2026-24686security
10 more lines
- Disable HTTP in namespaced policies by default (CVE-2026-4789)security
- Stdlib CVEsfixed
- CVEs - Release 1.16fixed
- Use scoped token for request authz (cherry-pick #15779 to release-1.16)fixed
- Add missing .chainsaw.yaml to conformance test directoriesfixed
- Prevent forEach mutation panic [release-1.16]fixed
- Resolve CVES for go < 1.25.8fixed
- Backport #c558d557349a70cd5de52f761db0bb98b6b8ab57 to 1.16other
- Cherry pickother
- Restrict configmap access for namespaced policies (Cherry-pickother
8 maintenance lines (dependency bumps, CI, tests, docs)
- Add trivy scan workflow (Cherry-pickmaintenance
- Backport ci changes from main to release-1.16 branchmaintenance
- Remove unnecessary jobs in conformance tests (Cherry-pickmaintenance
- Add missing scripts for ci (Cherry-pickmaintenance
- Release 1.16.4-rc.1maintenance
- Remove wrongly backported workflowsmaintenance
- Backport fixesmaintenance
- Release v1.16.4maintenance
30 lines13 security6 fixed3 other8 maintenancetyped from the source notes