chore(deps): update dependency kyverno/kyverno to v1.19.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
kyverno/kyverno	minor	v1.18.1 → v1.19.1

---

Release Notes

kyverno/kyverno (kyverno/kyverno)

v1.19.1

Compare Source

What's Changed

• fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by @​Manoj-Kumar-Selvaraj in #​17230
• fix: update Go to address CVE-2026-56853 by @​Sashang-debug in #​17232
• Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #​17262) by @​kyverno-pr-updater[bot] in #​17273
• fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #​17234) by @​realshuting in #​17298
• fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #​17299) by @​kyverno-pr-updater[bot] in #​17302
• fix: avoid data race in image evaluator prefetch (Cherry-pick #​17313) by @​kyverno-pr-updater[bot] in #​17327
• cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c) by @​realshuting in #​17307
• fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pick #​17310) by @​kyverno-pr-updater[bot] in #​17329
• fix(test): disable mutateDigest in exceptions-disabled IVPol by @​IceCodeBear in #​17336
• fix(test): loosen chainsaw stderr checks to contains by @​IceCodeBear in #​17334
• Bump kyverno sdk to 68d74af by @​raunak-nirmata in #​17349
• fix(test): disable IVPol digest defaults in leftover fixtures in v1.19 by @​IceCodeBear in #​17356
• fix(deps): bump golang.org/x/mod to v0.40.0 by @​IceCodeBear in #​17358
• fix: backport 7ac176a apiCall urlPath hardening to release-1.19 by @​realshuting in #​17361
• feat: phase1 deprecation warning plumbing and CLI warning enforcement (Cherry-pick #​17362) by @​kyverno-pr-updater[bot] in #​17378
• fix: validate PolicyException CEL match conditions (Cherry-pick #​17350) by @​kyverno-pr-updater[bot] in #​17373
• fix(test): disable IVPol digest defaults in leftover report fixtures by @​IceCodeBear in #​17376
• fix(background-controller): watch background-scan reports for the ephemeral reports circuit breaker (Cherry-pick #​17136) by @​kyverno-pr-updater[bot] in #​17430
• fix: handle missing reports CRDs as no-op in kyverno-init (Cherry-pick #​17420) by @​kyverno-pr-updater[bot] in #​17435
• feat: add deprecation warnings to legacy CRD versions and migrate test fixtures off v2beta1 (Cherry-pick #​17428) by @​kyverno-pr-updater[bot] in #​17434
• fix: skip namespace lookup in exception matching when no namespaceSelector is defined (Cherry-pick #​17140) by @​kyverno-pr-updater[bot] in #​17437
• fix(gpol): propagate synchronize option to UpdateRequests (Cherry-pick #​16920) by @​kyverno-pr-updater[bot] in #​17446
• fix(globalcontext): fix deadlocks in entry lifecycle and watch error handling (Cherry-pick #​16904) by @​kyverno-pr-updater[bot] in #​17454
• fix(webhook): avoid redundant recorder notifications (Cherry-pick #​17059) by @​kyverno-pr-updater[bot] in #​17451
• [release-1.19] fix: deny globalContext in namespaced policies (#​17377) by @​realshuting in #​17455
• [release-1.19] fix(cel): read PolicyExceptions from the manager cache, not a second informer (#​16993) by @​realshuting in #​17464
• fix(reports): fix label prefix and metadata for namespaced CEL policies (Cherry-pick #​17460) by @​kyverno-pr-updater[bot] in #​17480
• fix: close layer readers per-iteration to avoid FD/memory leak (Cherry-pick #​16994) by @​kyverno-pr-updater[bot] in #​17498
• [release-1.19] fix(deps): upgrade golang.org/x/crypto to v0.56.0 and grpc to v1.83.2 by @​realshuting in #​17513
• fix(gpol): recreate downstream resource after repeated deletions (Cherry-pick #​17453) by @​kyverno-pr-updater[bot] in #​17520
• fix: skip scalar values during wildcard image extraction (Cherry-pick #​16268) by @​kyverno-pr-updater[bot] in #​17521
• chore: cut release v1.19.1-rc.1 by @​realshuting in #​17522
• feat(cel): extend autogen to custom workload CRDs (JobSet, etc.) via structural extraction (Cherry-pick #​17014) by @​Rohanraj123 in #​17530
• fix(reports): discover autogen'd IVPol/NIVPol targets for background scan (Cherry-pick #​17395) by @​kyverno-pr-updater[bot] in #​17447
• chore: cut release v1.19.1 by @​realshuting in #​17541

New Contributors

• @​Manoj-Kumar-Selvaraj made their first contribution in #​17230

Full Changelog: kyverno/kyverno@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• fix: limit intermediate certs to mitigate CVE-2026-32280 by @​atharrva01 in #​15858
• ci: fix cosign releaser step by @​lucchmielowski in #​15932
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @​dependabot[bot] in #​15917
• Feat/cli apply cross resource by @​SargamPuram in #​15846
• automate stale PR updates by @​JimBugwadia in #​15942
• fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by @​JimBugwadia in #​15960
• fix permissions for pr-branch-updater by @​JimBugwadia in #​15967
• use existing PR updater token by @​JimBugwadia in #​15974
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @​dependabot[bot] in #​15976
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @​dependabot[bot] in #​15943
• update blocklist to allow in-cluster HTTP calls by @​JimBugwadia in #​15973
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @​dependabot[bot] in #​15954
• chore(deps): bump github.com/aptible/supercronic from 0.2.43 to 0.2.45 by @​dependabot[bot] in #​15961
• ci: Fix http conformance test blocklist by @​lucchmielowski in #​15986
• Add mpol handler gap tests (namespaced, exception, failurePolicy, dry-run, backgroundSA) by @​rx18-eng in #​15733
• chore: update available versions in issues by @​lucchmielowski in #​15996
• test: add dpol controller integration tests by @​rx18-eng in #​15859
• test: add gpol exception and CEL edge case integration tests by @​rx18-eng in #​15787
• refactor: drop reliance on EnvSet in favor of in-library versioning by @​aerosouund in #​16014
• fix(jmespath): prevent panic in label_match on nested structures by @​pulkitvats2007-crypto in #​15827
• fix: retry on conflict when updating policy status by @​williamclot in #​15754
• fix: restart dynamic watchers in background reporting on 410 by @​aerosouund in #​16028
• chore: add framework tests github workflow by @​aerosouund in #​15743
• fix: support cluster-scoped resource generation in GeneratingPolicy by @​realshuting in #​16018
• fix: pass AdmissionRequest to updaterequests for mutate existing policy by @​realshuting in #​16050
• fix(cli): fix resource lookup for MutatingPolicy, GeneratingPolicy and DeletingPolicy in test command by @​SargamPuram in #​15784
• ci: skip framework tests on docs-only and helm-only PRs by @​rx18-eng in #​16088
• fix(cli): add generatedResources field for GeneratingPolicy multi-resource tests by @​SargamPuram in #​16034
• Fix/cli multiple json payloads by @​SargamPuram in #​15584
• feat(cli): add offline mock support for http mock request/response for GET method and global context entries by @​SargamPuram in #​15948
• chore: add new gpol samples by @​realshuting in #​16097
• fix: validate name field in globalReference context entry by @​atharrva01 in #​16003
• fix(gctx): correctly track per-loader load state to avoid skipping LoadData by @​liuxu623 in #​16099
• fix: skip report creation for subresources with empty name/UID by @​realshuting in #​16114
• feat: add updaterequest total gauge metric by @​realshuting in #​16115
• feat(helm): support extraArgs in CRDs migration job by @​Suhani95 in #​16132
• feat: add non-goals by @​realshuting in #​16144
• chore: point to security assessments by @​realshuting in #​16145
• chore: update dependency policy by @​realshuting in #​16150
• fix(engine/vpol): include CEL validation expression index in policy report properties by @​Rohanraj123 in #​15916
• feat(helm): add optional PrometheusRule template by @​realshuting in #​16155
• chore: clarify performance baselines by @​realshuting in #​16154
• feat: update api docs by @​realshuting in #​16143
• feat: add NOTICE and embed attribution in container images by @​realshuting in #​16151
• feat: add opertional runbook by @​realshuting in #​16149
• feat(cli): add offline mock support for k8sresource-backed global context entries via inline and external resource manifests by @​SargamPuram in #​16123
• fix(helm): reportsServer.enabled=true fails with "Image tags must be strings" by @​yashrajshuklaaa in #​16167
• fix(Makefile): wire readiness-checker into local kind dev workflow by @​mastersans in #​16181
• test: add NewTestEnvWithOptions for opt-in policy type wiring by @​rx18-eng in #​16005
• fix(namespacedmutatingpolicy): fix crash loop, missing status, and recorder key by @​sandert-k8s in #​16055
• docs(perf-testing): add v1.18.1 CEL admission latency benchmarks and reorganize perf-testing layout by @​realshuting in #​16197
• test: add additional dpol controller integration tests by @​rx18-eng in #​15966
• ci: cache envtest binaries between framework test runs by @​rx18-eng in #​16110
• fix(dpol): apply namespaceSelector against Namespace resource own labels by @​realshuting in #​16200
• fix: do not abort required validation on non-matching images by @​lucchmielowski in #​16208
• fix(cli): allow multiple CRDs in to be in the --crd-path file by @​the-technat in #​16161
• test(integration): migrate gpol sync-clone scenarios from chainsaw by @​rx18-eng in #​16206
• fix: add the readiness checker to the ci image archive by @​aerosouund in #​16220
• fix: add access to clusterroles and bindings in the standard kyverno config by @​aerosouund in #​16219
• feat: Enable Cosign verbosity debugging by @​naseyro in #​16207
• chore: regenerate CRDs and docs after GHSA-79gf-7frw-68m9 API bump by @​realshuting in #​16241
• ci: bump codecov-action to v6.0.2 to fix uploader GPG key verification by @​rx18-eng in #​16273
• fix: support cel exception in cli apply 'exceptions-within-resources' by @​bakito in #​16178
• docs: fix duplicated word in cleanuppolicy validateAuth comment by @​s3onghyun in #​16279
• return correct results for NotEquals type mismatch cases by @​7se7en72025 in #​16276
• feat(cli): support multiple CRD paths and hook CRD processor into test command by @​asiyani in #​15824
• fix: wire gpolEngine and gpolProvider into policyController by @​yashrajshuklaaa in #​16171
• fix: nil pointer panic in getGpolTriggers on ListResource error by @​senutpal in #​16245
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by @​dependabot[bot] in #​16045
• Fix UR regression by @​avoidik in #​16280
• Fix context and SyncWatchers race conditions in GeneratingPolicy by @​Aneesh-Hegde in #​16041
• feat(pss-helm): add image to allowed volumetypes by @​yehlo in #​15906
• fix(generate): batch UpdateRequests to avoid etcd size limit by @​vmsilvamolina in #​15872
• fix(policy): apply orphanDownstreamOnPolicyDelete to clone cleanup by @​realshuting in #​16329
• fix(background): remove dead watcher entry on goroutine exit by @​Ebraam-Ashraf in #​16130
• fix(deps): bump golang.org/x/crypto to v0.53.0 and x/net to v0.56.0 to resolve security CVEs by @​realshuting in #​16340
• fix(generate): support NamespacedGeneratingPolicy end-to-end by @​realshuting in #​16338
• feat: honor expired CEL PolicyExceptions by @​realshuting in #​16299
• fix(background): scan NamespacedImageValidatingPolicy resources too by @​Proximyst in #​16301
• fix: validate stdin across apply paths by @​karthikmanam in #​16347
• feat(cli): add CEL http.Post mocking test fixtures, duplicate validation check, and integration tests by @​SargamPuram in #​16297
• fix(helm): serialize gh-pages publishes to prevent missing kyverno-policies releases by @​ANAMASGARD in #​16291
• chore(deps): bump actions/cache from 5.0.3 to 6.1.0 by @​dependabot[bot] in #​16371
• fix: upgrade go toolchain to 1.26.3 to resolve CVE-2026-39836 by @​aditip149209 in #​16361
• fix(deps): upgrade ristretto to v2 by @​chimanjain in #​16360
• fix: unblock ko image publish by replacing escaping kodata symlinks by @​realshuting in #​16381
• chore(workflow): dynamically discover active branches for Trivy issue sync by @​realshuting in #​16377
• fix CEL autogen namespace replacement by @​dag-andersen in #​16039
• fix(gpol): support mixed-type aggregate literals in CEL variables by @​realshuting in #​16339
• docs: fix README workflow badge and AI policy link by @​ObaidAbdullah16 in #​16162
• fix(deps): bump rekor and in-toto-golang for codeql alerts by @​realshuting in #​16394
• test: fix webhook registration typo by @​ObaidAbdullah16 in #​16164
• feat: support skipBackgroundRequests for CEL mpol/gpol by @​realshuting in #​16369
• test(chainsaw): fix NIVP background + clone-multiple-targets setup by @​realshuting in #​16399
• chore: update pond dependency to v2 by @​chimanjain in #​16379
• chore(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 by @​dependabot[bot] in #​16402
• Update backoff v7 by @​khiemdoan in #​16405
• Don't initialize rekor client for key or certificate based scenarios by @​aerosouund in #​16415
• chore(deps): bump fluxcd/flux2 from 2.8.5 to 2.8.6 by @​dependabot[bot] in #​15939
• test(chainsaw): fix clone-multiple-targets dynamic lookup fixture by @​realshuting in #​16414
• chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.40.0 by @​dependabot[bot] in #​15991
• chore(deps): bump golang.org/x/net from 0.48.0 to 0.55.0 in /hack/controller-gen by @​dependabot[bot] in #​16420
• test(integration): add YAML fixture loaders for the framework by @​rx18-eng in #​16229
• fix: preserve cluster-scoped generated resources by @​Suhani95 in #​16362
• fix(deps): patch ORAS and sigstore CodeQL vulnerabilities by @​realshuting in #​16426
• feat(gpol): support useServerSideApply for GeneratingPolicy by @​realshuting in #​16403
• fix(api): use allPath instead of anyPath in m.All validation loop by @​Utkal059 in #​16296
• fix: prevent ivpol webhook reconciliation loop on platforms that normalize namespaceSelector Fixes #​16256 by @​pyd-07 in #​16258
• fix(ci): use server-side apply for conformance CRD refresh by @​realshuting in #​16429
• fix: add sorting for ivpol targets by @​1vanden in #​16252
• fix(webhook): sort fine-grained policies to prevent continuous shuffle to the WebhookConfiguration's order by @​InsomniaCoder in #​15865
• fix(ci): force conflicts when server-side applying conformance CRDs by @​realshuting in #​16432
• fix(background-controller): wire MutatingPolicy and NamespacedMutatingPolicy into background scan by @​sandert-k8s in #​16255
• fix(reports): correct label prefix for mpol/dpol policies by @​atharrva01 in #​16452
• fix: ImageValidatingPolicy fails in air-gapped environments with insecureIgnoreTlog by @​hugolevino in #​16298
• fix(cli): surface GeneratingPolicy CEL errors when metadata.uid is missing by @​ANAMASGARD in #​16287
• chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.3 by @​dependabot[bot] in #​16442
• chore(deps): bump fossas/fossa-action from 1.9.0 to 2.0.0 by @​dependabot[bot] in #​16441
• fix: resolve context leak in dynamic resource watcher by @​AftAb-25 in #​16087
• feat(gpol): add auditAnnotations support to GeneratingPolicy by @​realshuting in #​16505
• fix: add policies.kyverno.io resources to aggregate policy roles by @​volantebjb in #​16239
• fix: address open CodeQL security vulnerabilities by @​realshuting in #​16528
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @​dependabot[bot] in #​16516
• chore(deps): bump actions/labeler from 6.0.1 to 6.2.0 by @​dependabot[bot] in #​16515
• Migrate yaml package gopkg.in/yaml.v2 to go.yaml.in/yaml/v3 by @​chimanjain in #​16511
• fix: skip reports RBAC check when background scanning is disabled by @​p-fruck in #​16490
• fix(readiness-checker): guard nil EndpointConditions.Ready to prevent panic by @​rootp1 in #​16544
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.8 to 1.2.9 by @​dependabot[bot] in #​16010
• chore(deps): bump the otel group across 1 directory with 4 updates by @​dependabot[bot] in #​16539
• chore(deps): bump Homebrew/actions/limit-pull-requests from 9ceb793 to 18fcb8e by @​dependabot[bot] in #​16562
• Test(conformance): pin Sigstore scaffolding version and remove redundant UR cleanup by @​Suhani95 in #​16572
• fix: resolve wildcard apiVersions GVR to GVK mapping failure in getGpolTriggers by @​Karthikk-18 in #​16525
• chore(deps): bump fluxcd/flux2/action from 2.8.6 to 2.9.2 by @​dependabot[bot] in #​16573
• chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.2 by @​dependabot[bot] in #​16575
• fix(chart): wire cleanup controller core extra resources by @​Suhani95 in #​16165
• fix(admissionpolicy): set a background user so CEL request.userInfo.username is available during scans by @​rx18-eng in #​16561
• chore(deps): bump cbrgm/cleanup-stale-branches-action from 1.2.9 to 1.2.11 by @​dependabot[bot] in #​16574
• fix: avoid mutating policy webhook name collisions by @​realshuting in #​16578
• fix: add missing reportProperties to v2beta1 Rule by @​zyzzmohit in #​15564
• test(integration): single-pass report aggregation helper + flagship test by @​rx18-eng in #​16244
• ci: add Semgrep SAST workflow by @​IceCodeBear in #​16464
• fix(helm): handle null image tags in _image.tpl and fix reports-server defaultTag by @​AftAb-25 in #​16063
• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​16576
• fix: key generate test clone sources by policy by @​Suhani95 in #​16450
• Fix: require --resource for migrate command by @​Suhani95 in #​16471
• fix(admissionpolicy): default userInfo groups and uid during background scans by @​rx18-eng in #​16592
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 by @​dependabot[bot] in #​16598
• fix: handle whitespace in mpol autogen Object constructor by @​santhil-cyber in #​16292
• chore(deps): bump github.com/aptible/supercronic from 0.2.45 to 0.2.47 by @​dependabot[bot] in #​16599
• chore(deps): bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.2 by @​dependabot[bot] in #​16600
• fix: suppress PolicyReport skip entries for ValidatingPolicy matchConditions non-matches by @​pyd-07 in #​16588
• fix(mpol): handle DELETE target expression using oldObject by @​realshuting in #​16610
• fix(webhook): serve NamespacedImageValidatingPolicy admission at right paths by @​rx18-eng in #​16611
• fix(perf-testing): eliminate data race on shared err variable in pod creation goroutines by @​Goutham-Annem in #​16630
• fix: add subtests and fix typo in ext/wildcard/match_test.go by @​Iqrima in #​16625
• fix: resolve error shadowing in SplitDocuments signature by @​Iqrima in #​16632
• fix: CustomNamespaceLister.List honors the label selector by @​7se7en72025 in #​16628
• chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 by @​dependabot[bot] in #​16621
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by @​dependabot[bot] in #​16619
• ci: migrate pr-branch-updater to GitHub App auth by @​JimBugwadia in #​16662
• chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @​dependabot[bot] in #​16620
• fix(mpol): allow ApplyConfiguration to mutate atomic lists and structs by @​rx18-eng in #​16509
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​dependabot[bot] in #​16669
• chore(deps): bump github.com/onsi/gomega from 1.40.0 to 1.42.1 by @​dependabot[bot] in #​16670
• refactor: add context propagation to background util functions by @​farhan11166 in #​16643
• cleanup: remove dead fakeContext code by @​aerosouund in #​16675
• feat: support MutatingPolicy target conditions and subresource targets by @​realshuting in #​16614
• fix(webhook): scope namespaced policies to their own namespace by @​rx18-eng in #​16615
• chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.3.2 to 6.4.2 by @​dependabot[bot] in #​16684
• chore(deps): bump Homebrew/actions/limit-pull-requests from 2026.07.13.1 to 2026.07.20.1 by @​dependabot[bot] in #​16681
• chore: bump controller-tools by @​eddycharly in #​16687
• fix: make file extension checks case-insensitive by @​Iqrima in #​16689
• chore(deps): bump actions/setup-python from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​16668
• fix(ivpol): add debug logging for CEL image verification functions by @​amarkdotdev in #​16305
• test: point ivpol cosign tests at the kyverno test-images registry by @​rx18-eng in #​16695
• feat: reuse image verification cache for ImageValidatingPolicy by @​bhuvan-somisetty in #​16694
• fix: enforce MutatingPolicy evaluation mode semantics by @​realshuting in #​16686
• ci: assign release milestone to PRs automatically at release time by @​JimBugwadia in #​16661
• chore(deps): bump actions/labeler from 6.2.0 to 7.0.0 by @​dependabot[bot] in #​16679
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in #​16680
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 by @​dependabot[bot] in #​16697
• fix: validate MAP-incompatible MutatingPolicy match conditions by @​realshuting in #​16698
• fix(policycache): surface audit-rule warnings for mixed audit and enforce policies by @​rx18-eng in #​16594
• fix(generate): reject stale trigger UIDs when live resource does not match by @​ANAMASGARD in #​16603
• Image verification credential handling refactor by @​aerosouund in #​16439
• fix(ivpol): support private Sigstore/Fulcio instances for keyless verification by @​JimBugwadia in #​16666
• feat: add YAML template mode for GeneratingPolicy with optional CEL interpolation by @​realshuting in #​16699
• feat: support MutatingAdmissionPolicy v1 on Kubernetes 1.36 by @​realshuting in #​16703
• fix: strip cross-namespace ownerReferences in CEL-based generation by @​realshuting in #​16716
• Fix DeletingPolicy objectSelector test results by @​Prachidg in #​16431
• feat(cel): add regex.replace extension function by @​tendinginfinity24 in #​16438
• fix: align dpol CLI reporting for constraint-excluded resources with vpol/mpol by @​realshuting in #​16727
• fix(ivpol): harden validation, cover ephemeral subresource, and serialize sigstore TUF access by @​JimBugwadia in #​16663
• fix(verification): use sigstore-go TUF client and fallback to trusted_root.json by @​rseleven in #​16591
• fix(ivpol): keep autogen variants per-policy to prevent cross-policy clobbering by @​rx18-eng in #​16731
• test(integration): add ImageValidatingPolicy support to the framework by @​rx18-eng in #​16730
• feat(mpol): add auditAnnotations support to MutatingPolicy by @​realshuting in #​16721
• fix: preserve namespaceSelector during policy autogen by @​pyd-07 in #​16476
• fix: align policy metrics for new policy formats by @​aditip149209 in #​16359
• fix: validate DeletingPolicy cron schedule at admission by @​Jayashanker-Padishala in #​16728
• [Feature] add optional cache bounds via --maxGlobalContextEntries by @​IceCodeBear in #​16560
• fix(webhook): add excludeBootstrapResources flag to skip Node and CSR on Fail webhooks by @​rx18-eng in #​16397
• fix(webhook): don't mark policies not ready or clear webhooks while health is unknown by @​rx18-eng in #​16434
• fix: prevent GlobalContextEntry informer failure from deadlocking the reconcile worker by @​realshuting in #​16739
• fix(helm): use request.namespace for vpolExclude matchConditions by @​swastikCommits in #​16751
• test(integration): align ivpol framework tests with single-phase image verification by @​rx18-eng in #​16741
• feat(helm): expose maxGlobalContextEntries in the Kyverno chart by @​IceCodeBear in #​16749
• chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.1 by @​dependabot[bot] in #​16770
• chore(deps): bump docker/login-action from 4.1.0 to 4.5.1 by @​dependabot[bot] in #​16767
• chore(deps): bump the kubernetes group across 3 directories with 7 updates by @​dependabot[bot] in #​16737
• chore(deps): bump github.com/sigstore/cosign/v3 from 3.0.6 to 3.1.2 by @​dependabot[bot] in #​16738
• restrict issue self-assignment to good first issues for non-members by @​realshuting in #​16776
• chore(deps): bump fluxcd/flux2/action from 2.9.2 to 2.9.3 by @​dependabot[bot] in #​16735
• chore(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in #​16733
• chore(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​16734
• fix: resolve namespaceObject with live API fallback on informer cache miss by @​realshuting in #​16784
• fix(cli): evaluate mutateExisting mutating policies on admission in test by @​rx18-eng in #​16618
• feat(cli): support admission operation simulation for policy testing by @​realshuting in #​16787
• fix: honor full-exemption PolicyException when multiple exceptions match by @​AftAb-25 in #​16060
• fix: allow pod-level seccomp in restrict-seccomp-strict vpol by @​Suhani95 in #​16249
• fix(engine): honor per-rule failureAction in the admission block deci… by @​rx18-eng in #​16558
• Moving the mixed-OS (Hybrid) cluster solution from controller specific nodeSelectors to the global values by @​kubeagon in #​15873
• fix(helm): disable in-process cert controller when cert-manager delegation is enabled by @​realshuting in #​16804
• Fix image verification parity gaps by [@​JimBugwadia](htt

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.