Kyverno Release Notes

What's Changed

• fix: bump Go 1.26.6 and x/net to resolve CVE-2026-39821 by @Manoj-Kumar-Selvaraj in https://github.com/kyverno/kyverno/pull/17230
• fix: update Go to address CVE-2026-56853 by @Sashang-debug in https://github.com/kyverno/kyverno/pull/17232
• Fix missing autogen webhook expansion for NamespacedValidatingPolicy (Cherry-pick #17262) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17273
• fix: apply HTTP blocklist to apiCall.service executor (cherry-pick #17234) by @realshuting in https://github.com/kyverno/kyverno/pull/17298
• fix: harden apiCall.service egress proxy path and cover CABundle branch (Cherry-pick #17299) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17302
• fix: avoid data race in image evaluator prefetch (Cherry-pick #17313) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17327
• cherry-pick: fix IVPol PolicyException scope bypass (GHSA-5cjf-wwfg-pj4c) by @realshuting in https://github.com/kyverno/kyverno/pull/17307
• fix: close IPv6-embedded-IPv4 blocklist bypass in apiCall.service egress (Cherry-pick #17310) by @kyverno-pr-updater[bot] in https://github.com/kyverno/kyverno/pull/17329
• fix(test): disable mutateDigest in exceptions-disabled IVPol by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17336
• fix(test): loosen chainsaw stderr checks to contains by @IceCodeBear in https://github.com/kyverno/kyverno/pull/17334 …

What's Changed

• fix: limit intermediate certs to mitigate CVE-2026-32280 by @atharrva01 in https://github.com/kyverno/kyverno/pull/15858
• ci: fix cosign releaser step by @lucchmielowski in https://github.com/kyverno/kyverno/pull/15932
• chore(deps): bump github.com/rs/zerolog from 1.35.0 to 1.35.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15917
• Feat/cli apply cross resource by @SargamPuram in https://github.com/kyverno/kyverno/pull/15846
• automate stale PR updates by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15942
• fix: revert 15880 - support httpAllowList and httpBlockList for cluster-scoped policies by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15960
• fix permissions for pr-branch-updater by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15967
• use existing PR updater token by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15974
• chore(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15976
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15943
• update blocklist to allow in-cluster HTTP calls by @JimBugwadia in https://github.com/kyverno/kyverno/pull/15973
• chore(deps): bump github.com/Azure/go-ntlmssp from 0.0.0-20221128193559-754e69321358 to 0.1.1 by @dependabot[bot] in https://github.com/kyverno/kyverno/pull/15954 …

What's Changed

• fix: restart dynamic watchers in background reporting on 410 (Cherry-pick #16028) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/16030
• fix: do not abort required validation on non-matching images (Cherry-pick #16208) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/16218
• fix(cli): allow multiple CRDs in to be in the --crd-path file (Cherry-pick #16161) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/16215
• fix(gpol,mpol): enforce namespace boundary in generator.apply() (backport GHSA-79gf-7frw-68m9 to release-1.18) by @realshuting in https://github.com/kyverno/kyverno/pull/16238
• feat(pss-helm): add image to allowed volumetypes (Cherry-pick #15906) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/16332
• backport(release-1.18): security dependency bumps from #16340 by @realshuting in https://github.com/kyverno/kyverno/pull/16343
• fix(release-1.18): roll up codeql dependency and toolchain updates by @realshuting in https://github.com/kyverno/kyverno/pull/16395
• fix(reports): correct label prefix for mpol/dpol policies (Cherry-pick #16452) by @kyverno-bot in https://github.com/kyverno/kyverno/pull/16453
• chore: cut v1.18.2-rc.2 by @realshuting in https://github.com/kyverno/kyverno/pull/16517
• chore: cut v1.18.2 by @realshuting in https://github.com/kyverno/kyverno/pull/16526

Full Changelog: https://github.com/kyverno/kyverno/compare/v1.18.1...v1.18.2