All mandatory release validation and remote verification completed for 24e23f9328749fba9f9b249ce8b10c732517d9c8. Charts: {"kyverno": "3.10.0-rc.1", "kyverno-policies": "3.10.0-rc.1"}. Full matrix and diagnostics: https://github.com/kyverno/kyverno/actions/runs/41530175668.
Security Kyverno v1.19.2 addresses 24 published GitHub Security Advisories: 9 Critical, 14 High, and 1 Moderate. The fixes include: Cherry-pick workflow script-injection hardening (Critical): GHSA-5gq8-3xxc-jm92 (#18014). API path validation and namespace confinement (Critical): GHSA-3xfv-vq8x-qhg4, GHSA-pcx2-xcq4-65vf, GHSA-4pqm-wqq6-h9q2, GHSA-p58h-r4j3-h5vx, and GHSA-rcxg-3f92-3mgr (#17984, #18…
Signed-off-by: aerosouund aerosound161@gmail.com Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: aerosouund aerosound161@gmail.com Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: aerosouund aerosound161@gmail.com Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: aerosouund aerosound161@gmail.com Co-authored-by: Claude Opus 5.5 noreply@anthropic.com
chore: pass GORELEASER_CURRENT_TAG to the goreleaser (#18124) Signed-off-by: aerosouund <aerosound161@gmail.com>
What's Changed [release-1.19] fix(deps): update x/net for CVE-2026-97032 by @Sashang-debug in #18027 [release-1.19] fix(deps): update x/net for CVE-2026-78663 by @Sashang-debug in #18025 fix: repair the post-merge Tests workflow on main (#17761) by @aerosouund in #18035 test: expect the generation label protection webhook in chainsaw asserts by @aerosouund in #18039 [release-1.19] fix: preserve le…
[release-1.19] fix: preserve legacy generation scope and ownership (#…
Define schema-driven CEL evaluation for JSON and protobuf payloads, including typed activation, routing, transport integration, migration, and alternatives. Signed-off-by: Jim Bugwadia jim@nirmata.com Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com
test: expect the generation label protection webhook in chainsaw asse… …rts (#18039) #18033 always adds protect-generation-labels.kyverno.svc to kyverno-resource-validating-webhook-cfg, so every assert that lists that configuration's webhooks now fails with "lengths of slices don't match". Add the webhook at its name-sorted position in each of those asserts. Signed-off-by: aerosouund <aerosound161…
fix(pss): map procMount_restricted for user namespace pods Map the PSA fork's new procMount_restricted check to the /proc Mount Type control so exclusions, PolicyExceptions and reports keep working, and add unit and CLI tests for hostUsers: false. Refs #15981 Depends on kyverno/pod-security-admission#6 Signed-off-by: Suhani suhani4630@gmail.com chore(deps): bump kyverno/pod-security-admission to 4…
kyverno-chart-3.9.1
kyverno-policies-chart-3.9.1
What's Changed fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by @Manoj-Kumar-Selvaraj in #17230 fix: update Go to address CVE-2026-56853 by @Sashang-debug in #17232 Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #17262) by @kyverno-pr-updater[bot] in #17273 fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #17234) by @realshuting in #17…
No content.
What's Changed fix: limit intermediate certs to mitigate CVE-2026-32280 by @atharrva01 in #15858 ci: fix cosign releaser step by @lucchmielowski in #15932 chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in #15917 Feat/cli apply cross resource by @SargamPuram in #15846 automate stale PR updates by @JimBugwadia in #15942 fix: revert 15880 - support httpAllowList and…
kyverno-chart-3.9.0
kyverno-policies-chart-3.9.0
No content.
kyverno-policies-chart-3.9.0-rc.4
kyverno-chart-3.9.0-rc.4
No content.
kyverno-chart-3.9.0-rc.3
kyverno-policies-chart-3.9.0-rc.3
No content.
kyverno-chart-3.9.0-rc.2
kyverno-policies-chart-3.9.0-rc.2
No content.
kyverno-policies-chart-3.9.0-rc.1