From 2a8c54610810430cb377ab7b5074ae824342e5b4 Mon Sep 17 00:00:00 2001 From: neuvector Date: Thu, 15 Oct 2026 16:57:31 +0000 Subject: [PATCH 1/4] Add 5.6.3 release notes --- docs/14.releasenotes/01.5x/01.5x.md | 31 ++++++++++++++++++ .../14.releasenotes/01.5x/01.5x.md | 32 +++++++++++++++++++ 2 files changed, 63 insertions(+) diff --git a/docs/14.releasenotes/01.5x/01.5x.md b/docs/14.releasenotes/01.5x/01.5x.md index 67816040..19f471f6 100644 --- a/docs/14.releasenotes/01.5x/01.5x.md +++ b/docs/14.releasenotes/01.5x/01.5x.md @@ -13,6 +13,37 @@ To receive email notifications of new releases, please subscribe to this SUSE ma ::: +#### 5.6.3 October 2026 + +:::note +If it's upgrade from NeuVector pre-5.6.0 to 5.6.3, all NeuVector scanner pods needs to be restarted for supporting Critical CVE severity. +::: + +##### Feature requests + +- **issue-2870**: Support authenticated webhook notifications in NeuVector + +##### Enhancement + +- **issue-2833**: Let UI show message when the mapped role of a server user is empty + +##### Bug fixes + +- **issue-2925**: check the id instead of name, also enrich the fail log +- **issue-2750**: process rules not always working. +- **issue-2804**: automated federation join failed with controller ha setup +- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh +- **fix**: (nvbench) correct RKE2 kubelet configuration checks +- **fix**: (crd) allow dry-run admission requests instead of denying them +- **fix**: (rke2) read eventRecordQPS from kubelet configuration +- **fix**: (nvbench) resolve RKE2 worker paths from process arguments +- **fix**: RKE2 kubelet client CA check +- **fix**: (nvbench) check rke2 client ca ownership by path +- **fix**: keep IPv6 client addresses intact in auth audit events +- **fix**: add missing scanrunning caps +- **chore(deps)**: dependency updates & golang upgrade + + #### 5.6.2 September 2026 :::note diff --git a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md index fba07697..87903d69 100644 --- a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md +++ b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md @@ -13,6 +13,38 @@ To receive email notifications of new releases, please subscribe to this SUSE ma ::: +#### 5.6.3 October 2026 + +:::note Critical CVE Stats After Upgrades +When upgrading controllers to version `5.6.3 (or later) from a version that does not support critical-level severity (e.g., `5.5.3`), existing scanner pods must be restarted or redeployed. + +Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup. +::: + +##### Feature requests + +- **issue-2870**: Support authenticated webhook notifications in NeuVector + +##### Enhancement + +- **issue-2833**: Let UI show message when the mapped role of a server user is empty + +##### Bug fixes + +- **issue-2925**: check the id instead of name, also enrich the fail log +- **issue-2750**: process rules not always working. +- **issue-2804**: automated federation join failed with controller ha setup +- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh +- **fix**: (nvbench) correct RKE2 kubelet configuration checks +- **fix**: (crd) allow dry-run admission requests instead of denying them +- **fix**: (rke2) read eventRecordQPS from kubelet configuration +- **fix**: (nvbench) resolve RKE2 worker paths from process arguments +- **fix**: RKE2 kubelet client CA check +- **fix**: (nvbench) check rke2 client ca ownership by path +- **fix**: keep IPv6 client addresses intact in auth audit events +- **fix**: add missing scanrunning caps +- **chore(deps)**: dependency updates & golang upgrade + #### 5.6.2 September 2026 :::note Critical CVE Stats After Upgrades From e18fd2877095a3db8941b5b921c7328f5f9bc935 Mon Sep 17 00:00:00 2001 From: neuvector Date: Thu, 15 Oct 2026 19:36:55 +0000 Subject: [PATCH 2/4] Add 5.6.3 release notes --- docs/14.releasenotes/01.5x/01.5x.md | 36 ++++++++++--------- .../14.releasenotes/01.5x/01.5x.md | 32 ++++++++--------- 2 files changed, 35 insertions(+), 33 deletions(-) diff --git a/docs/14.releasenotes/01.5x/01.5x.md b/docs/14.releasenotes/01.5x/01.5x.md index 19f471f6..7fafcd51 100644 --- a/docs/14.releasenotes/01.5x/01.5x.md +++ b/docs/14.releasenotes/01.5x/01.5x.md @@ -15,33 +15,35 @@ To receive email notifications of new releases, please subscribe to this SUSE ma #### 5.6.3 October 2026 -:::note -If it's upgrade from NeuVector pre-5.6.0 to 5.6.3, all NeuVector scanner pods needs to be restarted for supporting Critical CVE severity. +:::note note Critical CVE Stats After Upgrade +Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity. + +Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup. ::: ##### Feature requests -- **issue-2870**: Support authenticated webhook notifications in NeuVector +- **issue-2870**: Support authenticated webhook notifications in NeuVector. ##### Enhancement -- **issue-2833**: Let UI show message when the mapped role of a server user is empty +- **issue-2833**: UI shows messaging when the mapped role of a server user is empty ##### Bug fixes -- **issue-2925**: check the id instead of name, also enrich the fail log -- **issue-2750**: process rules not always working. -- **issue-2804**: automated federation join failed with controller ha setup -- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh -- **fix**: (nvbench) correct RKE2 kubelet configuration checks -- **fix**: (crd) allow dry-run admission requests instead of denying them -- **fix**: (rke2) read eventRecordQPS from kubelet configuration -- **fix**: (nvbench) resolve RKE2 worker paths from process arguments -- **fix**: RKE2 kubelet client CA check -- **fix**: (nvbench) check rke2 client ca ownership by path -- **fix**: keep IPv6 client addresses intact in auth audit events -- **fix**: add missing scanrunning caps -- **chore(deps)**: dependency updates & golang upgrade +- **issue-2925**: Check the id instead of name, also enrich the fail log. +- **issue-2750**: Process rules not always working. +- **issue-2804**: Automated federation join failed with controller HA setup. +- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh. +- **fix**: (nvbench) Correct RKE2 kubelet configuration checks. +- **fix**: (crd) Allow dry-run admission requests instead of denying them. +- **fix**: (RKE2) Read eventRecordQPS from kubelet configuration. +- **fix**: (nvbench) Resolve RKE2 worker paths from process arguments. +- **fix**: (RKE2) kubelet client CA check. +- **fix**: (nvbench) Check RKE2 client CA ownership by path. +- **fix**: Keep IPv6 client addresses intact in auth audit events. +- **fix**: Add missing scanrunning caps. +- **chore(deps)**: Dependency updates & golang upgrade. #### 5.6.2 September 2026 diff --git a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md index 87903d69..eb543ca3 100644 --- a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md +++ b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md @@ -16,34 +16,34 @@ To receive email notifications of new releases, please subscribe to this SUSE ma #### 5.6.3 October 2026 :::note Critical CVE Stats After Upgrades -When upgrading controllers to version `5.6.3 (or later) from a version that does not support critical-level severity (e.g., `5.5.3`), existing scanner pods must be restarted or redeployed. +Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity. Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup. ::: ##### Feature requests -- **issue-2870**: Support authenticated webhook notifications in NeuVector +- **issue-2870**: Support authenticated webhook notifications in NeuVector. ##### Enhancement -- **issue-2833**: Let UI show message when the mapped role of a server user is empty +- **issue-2833**: UI shows messaging when the mapped role of a server user is empty ##### Bug fixes -- **issue-2925**: check the id instead of name, also enrich the fail log -- **issue-2750**: process rules not always working. -- **issue-2804**: automated federation join failed with controller ha setup -- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh -- **fix**: (nvbench) correct RKE2 kubelet configuration checks -- **fix**: (crd) allow dry-run admission requests instead of denying them -- **fix**: (rke2) read eventRecordQPS from kubelet configuration -- **fix**: (nvbench) resolve RKE2 worker paths from process arguments -- **fix**: RKE2 kubelet client CA check -- **fix**: (nvbench) check rke2 client ca ownership by path -- **fix**: keep IPv6 client addresses intact in auth audit events -- **fix**: add missing scanrunning caps -- **chore(deps)**: dependency updates & golang upgrade +- **issue-2925**: Check the id instead of name, also enrich the fail log. +- **issue-2750**: Process rules not always working. +- **issue-2804**: Automated federation join failed with controller HA setup. +- **issue-1310**: Newly added registry in "Assets -> Registries" is not displayed until manual page refresh. +- **fix**: (nvbench) Correct RKE2 kubelet configuration checks. +- **fix**: (crd) Allow dry-run admission requests instead of denying them. +- **fix**: (RKE2) Read eventRecordQPS from kubelet configuration. +- **fix**: (nvbench) Resolve RKE2 worker paths from process arguments. +- **fix**: (RKE2) kubelet client CA check. +- **fix**: (nvbench) Check RKE2 client CA ownership by path. +- **fix**: Keep IPv6 client addresses intact in auth audit events. +- **fix**: Add missing scanrunning caps. +- **chore(deps)**: Dependency updates & golang upgrade. #### 5.6.2 September 2026 From 0e48a04040c82b2e38627168a3d8d1e3416c9f3f Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 15 Oct 2026 12:46:34 -0700 Subject: [PATCH 3/4] Update versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md --- versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md index eb543ca3..52336421 100644 --- a/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md +++ b/versioned_docs/version-5.6/14.releasenotes/01.5x/01.5x.md @@ -15,7 +15,7 @@ To receive email notifications of new releases, please subscribe to this SUSE ma #### 5.6.3 October 2026 -:::note Critical CVE Stats After Upgrades +:::note Critical CVE Stats After Upgrade Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity. Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup. From dcc18410e3bf7b8b6ada468363f25223205f7af3 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Thu, 15 Oct 2026 13:17:03 -0700 Subject: [PATCH 4/4] Update docs/14.releasenotes/01.5x/01.5x.md rm repeated word --- docs/14.releasenotes/01.5x/01.5x.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/14.releasenotes/01.5x/01.5x.md b/docs/14.releasenotes/01.5x/01.5x.md index 7fafcd51..1d2d9ebc 100644 --- a/docs/14.releasenotes/01.5x/01.5x.md +++ b/docs/14.releasenotes/01.5x/01.5x.md @@ -15,7 +15,7 @@ To receive email notifications of new releases, please subscribe to this SUSE ma #### 5.6.3 October 2026 -:::note note Critical CVE Stats After Upgrade +:::note Critical CVE Stats After Upgrade Upgrading to NeuVector v5.6.3 or later from any version prior to v5.6.0 requires all existing NeuVector scanner pods to be restarted or redeployed to support CVE critical-level severity. Older scanner pods cache the controller's initial capability response. They will not recognize that the upgraded controller supports critical-level severity until they are restarted and re-query the controller on startup.