[dependabot]

Bumps github.com/kyverno/kyverno from 1.5.0-rc1.0.20250917075031-67ba05a0a08d to 1.16.0-rc.2.

Release notes

Sourced from github.com/kyverno/kyverno's releases.

v1.16.0-rc.2

No release notes provided.

v1.16.0-rc.1

No release notes provided.

v1.15.2

🐛 Fixed 🐛

• Fixed CLI apply command return code regardless of output format (#12629)
• Fixed resource name matching for edge case when name is auto-generated (#13584)
• Fixed namespace termination logging (#13866)
• Updated conditional logic to correct reportsServer value reference (#13893)
• Fixed background scan reporting to consume resourceFilter for new policy types (#13919)
• Fixed issue to evaluate userInfo for VAPs and MAPs in the CLI (#13920)
• Shortened helm hook names (#13966)
• Fixed issue to block mutating policies upon compilation errors (#13972)
• Fixed namespace selector matching for PolicyException (#13975)

Helm

• Split openreports CRD installation from controller flag enabling in the helm chart (#13924)
• Fixed repository customization for helm hooks (#13933)
• Removed warnings related to VAPs in the chart (#13990)

🔧 Others 🔧

• Used pointer in validate (assert field) (#12373)
• Added unit test for pkg/background/dynamic_watcher.go (#13800)
• Added tests for VAPs that match subresource (#13947)
• Fixed chainsaw tests (#13992, #13976, #13923)
• Used namespace lister in background controller (#14002)

Full Changelog: kyverno/kyverno@v1.15.1...v1.15.2

v1.15.2-rc.1

No release notes provided.

v1.15.1

✨ Added ✨

• Implement CRD change callbacks and ignore resource not found error (#13534)

⚠️ Changed ⚠️

• Update kubectl image and removed unused hooks (#13837)

🐛 Fixed 🐛

• Fix CVE-2025-47907 (#13822)
• Fix JSON logging format not working correctly (#13756)
• Fix a panic issue to not error out if resolving kinds fails for a cel based policy (#13754)
• Fix the error when update lastRefreshInterval of the globalcontextentry (#13700)
• Fix the issue to not escape shallow vars during validation (#12039)
• Replace openreports module name with the new name after the change in the openreports repo (#13768)
• Fix the error in the reports controller when parse the wildcard * match resource (#13793)

... (truncated)

Changelog

Sourced from github.com/kyverno/kyverno's changelog.

v1.13.0

Note

• Removed deprecated flag reportsChunkSize.
• Added --tufRootRaw flag to pass tuf root for custom sigstore deployments.

Bug Fixes

• Fixed inconsistent ordering of imagePullSecrets in Helm charts which could cause GitOps tools like ArgoCD to show OutOfSync status (#12995)

v1.11.0

v1.11.0-rc.1

Note

• Added --tufRoot and --tufMirror flags to configure tuf for custom sigstore deployments.
• Remove description from deprecated fields in CRDs
• Remove CLI kyverno test manifest ... commands (replaced by kyverno create ...).
• Added --caSecretName and --tlsSecretName flags to control names of certificate related secrets.
• Added match conditions support in kyverno config map.
• Deprecated flag --imageSignatureRepository. Will be removed in 1.12. Use per rule configuration verifyImages.Repository instead.
• Added --aggregateReports flag for reports controller to enable/disable aggregated reports (default value is true).
• Added --policyReports flag for reports controller to enable/disable policy reports (default value is true).
• Renamed CLI flag --compact to --detailed-results (and changed default value from true to false).
• Changed the default value of --enablePolicyException from false to true.

v1.10.0

v1.10.0-rc.1

Note

• Removed GenerateRequest CRD.
• Refactored kyverno chart, migration instructions are available in chart README.md.
• Image references in the json context are not mutated to canonical form anymore, do not assume a registry domain is always present.
• Added support for configuring webhook annotations in the config map through webhookAnnotations stanza.
• Added excludeRoles and excludeClusterRoles support in configuration.
• Added new flag skipResourceFilters to reports controller to enable/disable considering resource filters in the background (default value is true)
• Removed hardcoded defaults for excludeGroups and excludeUsernames. They are always read from the config map.

v1.9.0-rc.1

Note

• Flag backgroundScanInterval was added to force background scans at regular intervals (default value is 1h).
• Flag splitPolicyReport was removed, was unused and marked for removal in 1.9.
• Webhook is no longer updated to match pods/ephemeralcontainers when policy only specifies pods. If users want to match on pods/ephemeralcontainers, they must specify pods/ephemeralcontainers in the policy.
• Webhook is no longer updated to match services/status when policy only specifies services. If users want to match on services/status, they must specify services/status in the policy.
• Flag autogenInternals was removed, policy mutation has been removed.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)