Changelog

• 411b179 Cache compiled CEL programs across scanned objects (#2503)
• 6bbcccd Derive cmd/vap policy metadata from the embedded VAP bundle (#2485)
• 1a6cf89 Embed and load VAP YAML from the vendored bundle (#2474)
• 6cb59a4 Expand encryption and decryption coverage for resource metadata (#2442)
• df44c79 Fix air-gapped mode -- thread explicit offline flag to policy getters instead of relying on nil (#2458)
• 949a569 Fix control-inputs fallback to return real local getter instead of unloaded store (#2515)
• e4ab628 Fix local control cache (#2463)
• 3c4b059 Fix/helm templates plain yaml warnings (#2509)
• efb658f Vendor the CEL admission policy bundle (#2455)
• 7dbe430 [ LFX 2026] feat(exceptions): honor objectSelector.matchExpressions via PostureExceptionPolicy.ObjectSelector (#2480)
• 8a2e1a2 [Fix] : severity-based image exceptions in JSON, SARIF, and patch output -- use filtered Matches instead of RemainingMatches (#2522)
• 5afd77b add unit tests for GetPreReqCmd and kubeconfig flag (#2486)
• 21e2db5 core: Add test coverage for Kubescape.Diff pretty-printer output path (#2467)
• 55df2bd docs(cli): document report protection workflow (#2508)
• ef65747 docs(cli): improve report protection help and examples (#2510)
• 80191c7 feat(anonymizer): support reversible container metadata transformation (#2473)
• 3f29f09 feat(mcp): Add headless OPAProcessor for low-latency Network Policy s… (#2512)
• 062d9cf feat(mcp): implement headless OPAProcessor rbac scanner (#2492)
• f68fdc0 feat(operator): add quarantine action to remediate CLI subcommand (#2461)
• 29928b8 feat(patch): add support for OCI and Local exports (#2471)
• 79ae44e feat(printer): add GitLab SAST report output format (#2505)
• df68301 feat(reportcrypto): add decryption support for encrypted resource metadata (#2493)
• b830283 feat: add container profile tools and resources to MCP server (#2479)
• 5757418 feat: implement AWS ECR vulnerability adaptor (#2488)
• 20b5a83 feat: introduce Container Image Vulnerability (CIV) Adaptor interfaces (#2482)
• 9ea839a feat: run CEL controls as part of the scan (#2525)
• f7e805a fix(httphandler): add missing panic recovery to Metrics handler (#2465)
• 05e3cc9 fix(httphandler): decouple prometheus metrics scan from request context (#2451)
• 8d5d0d7 fix(httphandler): populate report in synchronous scan response (#2483)
• 4d80ab4 fix(imagescan): preserve matches on metadata lookup errors (#2519)
• 5b93069 fix(mcp): add double-checked mutex locking to k8sClient lazy init (#2506)
• 0b3d0f6 fix(printer): don't append .txt to /dev/null in PrettyPrinter.SetWriter (#2502)
• 6ba3a1d fix(sarif): don't os.Exit on unencodable fix, avoid empty SARIF file (#2499)
• ef6b608 fix(sarif): surface PrettyWrite errors instead of silently writing empty file (#2497)
• 8fb2eb1 fix(scan): don't let --exceptions/--controls-config/--attack-tracks trigger air-gapped mode (#2532)
• 497f086 fix(scan): restore root PersistentPreRun for kubescape scan invocations (#2530)
• 2adea95 fix(vap): deploy-library serves the embedded bundle, downloads only via --from-release (#2507) (#2514)
• 82dd34d fix: preserve explicit exceptions/inputs with use-artifacts-from (#2490)
• 81617ed fix: support namespace/kind/name workload format (#2459) (#2460)
• 85933c9 rbac file todo to check api version is resolved (#2523)
• 5bffddf refactor: decompose monolithic Results API handler (#2477)
• 11a05e1 test(core): cover Kubescape.Download unknown-target error path (#2468) Released by GoReleaser.