Kyverno v1.19.2
security+~*********!!!!!!!
Changes
- Cherry-pick workflow script-injection hardening (Critical): GHSA-5gq8-3xxc-jm92 (#18014).security
- API path validation and namespace confinement (Critical): GHSA-3xfv-vq8x-qhg4, GHSA-pcx2-xcq4-65vf, GHSA-4pqm-wqq6-h9q2, GHSA-p58h-r4j3-h5vx, and GHSA-rcxg-3f92-3mgr (#17984, #18021).security
- NamespacedMutatingPolicy target confinement (Critical and High): GHSA-jcw5-3wcg-fqx5, GHSA-f96w-622v-rqpq, and GHSA-vm98-8c25-h274 (#17984, #18021).security
- PolicyException enforcement in generated admission policies (High): GHSA-qc9c-3fgf-cgq8 (#17987).security
- CEL evaluation cost limits (Moderate): GHSA-m8p2-qqmx-j53x (#17989).security
- Bounded wildcard matching, safer variable substitution, and panic prevention (High): GHSA-8mrj-27wr-599g, GHSA-338x-hgrv-626h, GHSA-r2p2-3892-5jjf, and GHSA-x4xq-p8g4-6fwg (#17991).security
- Image verification and attestation hardening (Critical and High): GHSA-h3pm-q9ww-f439, GHSA-fcfr-fr8g-qjqv, GHSA-24cc-9745-hxfc, GHSA-2r43-6962-xcw5, GHSA-3f2c-hfj8-542w, and GHSA-fr24-3hvf-393q (#17994, #17996).security
- Generate authorization, clone namespace confinement, and internal-label protections (High): GHSA-q62c-r9v2-cf64, GHSA-hg5v-hwm3-956r, and GHSA-493q-9xvg-9xf3 (#17937, #17938).security
- [release-1.19] fix(deps): bump go to 1.26.9 to fix CVE-2026-97031security
- [1.19] fix(security): API path validation, apiCall canonicalization, mpol/cleanup namespace confinementsecurity
- [1.19] fix(security): harden cherry-pick workflows against script injectionsecurity
- Cherry-pick N4K #1077 and #1164 (namespace clamp) to release-1.19security
27 more lines
- [release-1.19] fix(deps): update x/net for CVE-2026-97032security
- [release-1.19] fix(deps): update x/net for CVE-2026-78663security
- Reduce engine context checkpoint copy costchanged
- Build the request activation once per admission request (Cherry-pickchanged
- Hoist the request-map build in the ivpol engine (Cherry-pickchanged
- Add filter field to imageExtractors for wildcard array filteringadded
- Support Pod user namespaces in PSS policies (Cherry-pickadded
- Support additionalExtensions for keyless signing in the ivpol (Cherry-pickadded
- Process namespaced resources with pagination (Cherry-pickfixed
- Avoid image validating policy webhook name collisions (Cherry-pickfixed
- Autogen fine-grained namespaced image policies (Cherry-pickfixed
- Resolve match constraints for namespaced validating policies (cherry-pickfixed
- Enforce exceptionNamespace for CEL PolicyExceptions (Cherry-pickfixed
- Preserve MutatingPolicy reinvocation policy (Cherry-pickfixed
- Preserve GeneratingPolicy skips in test results (Cherry-pickfixed
- Resolve generate triggers by name instead of listing the namespace (Cherry-pickfixed
- Evaluate matchConditions during background mutateExisting evaluation (Cherry-pickfixed
- Verify annotations properly for cosign v2 and v3 (Cherry-pickfixed
- Bound the reads image verification makes from a registryfixed
- Bound wildcard matching and variable substitutionfixed
- Verify at admission instead of trusting prior-stage metadatafixed
- Apply the runtime PolicyException gates in the admission-policy generatorfixed
- Bound the cost of CEL policy expression evaluationfixed
- Preserve controller-owned generation labelsfixed
- Support user namespace pods in validate.podSecurityfixed
- Repair the post-merge Tests workflow on mainfixed
- [release-1.19] fix: preserve legacy generation scope and ownershipother
8 maintenance lines (dependency bumps, CI, tests, docs)
- Record failed job instances in workflow failure issues (Cherry-pickmaintenance
- CEL admission-path allocation-regression gate (post-merge) (Cherry-pickmaintenance
- Bump kyverno sdk version to the latest commit (Cherry-pickmaintenance
- Cover CRD-aware policy test mapping (Cherry-pickmaintenance
- Expect the generation label protection webhook in chainsaw assertsmaintenance
- Pass GORELEASER_CURRENT_TAG to the goreleasermaintenance
- Bump chart to 3.9.2-rc.5 for v1.19.2-rc.5maintenance
- Bump chart to 3.9.2 for v1.19.2maintenance
47 lines14 security3 added3 changed18 fixed1 other8 maintenancetyped from the source notes