[bitnami/kubescape] Release 4.0.10-debian-12-r0 (#95160)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>

bitnami/kubescape/4/debian-12/Dockerfile

@@ -7,13 +7,13 @@ ARG DOWNLOADS_URL="https://downloads.bitnami.com/files/stacksmith"
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-07-02T11:08:44Z" \
+      org.opencontainers.image.created="2026-07-06T14:01:05Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/kubescape/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/kubescape" \
       org.opencontainers.image.title="kubescape" \
       org.opencontainers.image.vendor="Broadcom, Inc." \
-      org.opencontainers.image.version="4.0.9"
+      org.opencontainers.image.version="4.0.10"
 
 ENV HOME="/opt/bitnami/kubescape" \
     OS_ARCH="${TARGETARCH:-amd64}" \
@@ -29,7 +29,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     DOWNLOADS_URL=${SECRET_DOWNLOADS_URL:-${DOWNLOADS_URL}} ; \
     mkdir -p /tmp/bitnami/pkg/cache/ ; cd /tmp/bitnami/pkg/cache/ || exit 1 ; \
     COMPONENTS=( \
-      "kubescape-4.0.9-2-linux-${OS_ARCH}-debian-12" \
+      "kubescape-4.0.10-0-linux-${OS_ARCH}-debian-12" \
     ) ; \
     for COMPONENT in "${COMPONENTS[@]}"; do \
       if [ ! -f "${COMPONENT}.tar.gz" ]; then \
@@ -47,9 +47,9 @@ RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
 
 COPY rootfs /
 RUN /opt/bitnami/scripts/kubescape/postunpack.sh
-ENV APP_VERSION="4.0.9" \
+ENV APP_VERSION="4.0.10" \
     BITNAMI_APP_NAME="kubescape" \
-    IMAGE_REVISION="3"
+    IMAGE_REVISION="0"
 
 USER 1001
 ENTRYPOINT [ "/opt/bitnami/scripts/kubescape/entrypoint.sh" ]

bitnami/kubescape/4/debian-12/prebuildfs/opt/bitnami/checksums/kubescape-4.0.10-0-linux-amd64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+0048c78ce40800e1d2a7924b639b89fd07113028d8b8c874e287fa40fafe8744  kubescape-4.0.10-0-linux-amd64-debian-12.tar.gz

bitnami/kubescape/4/debian-12/prebuildfs/opt/bitnami/checksums/kubescape-4.0.10-0-linux-arm64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+bf1d2e04fad5f058770b501dac9ae2126006229c9397694ec1b53fcc5b2af269  kubescape-4.0.10-0-linux-arm64-debian-12.tar.gz

bitnami/kubescape/4/debian-12/prebuildfs/opt/bitnami/checksums/kubescape-4.0.9-2-linux-amd64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-1ade97efdb2ca135c3f9a0587096df63740e549d6e74efb1fe200a3b5c09fbd2  kubescape-4.0.9-2-linux-amd64-debian-12.tar.gz

bitnami/kubescape/4/debian-12/prebuildfs/opt/bitnami/checksums/kubescape-4.0.9-2-linux-arm64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-cbb4b52087bcf255a219b5dc548eaa7437f3228865f9ec58e3e541dfee98e190  kubescape-4.0.9-2-linux-arm64-debian-12.tar.gz

bitnami/kubescape/4/debian-12/rootfs/opt/bitnami/scripts/libkubescape.sh

@@ -130,12 +130,18 @@ kubescape_oss_assessment() {
   fi
 
   # Run Kubescape scan for the provided project and add custom field 'security'
+  # NOTE: '--output' is used (instead of parsing stdout) because kubescape also prints a human-readable
+  # summary to stdout alongside the JSON report, which would otherwise break JSON parsing
   info "Running command '${cmd} ${scan_args[*]}'"
+  local scan_output_file
+  scan_output_file="$(mktemp --suffix=.json)"
   if is_boolean_yes "$silent"; then
-    KUBESCAPE_OUTPUT="$(${cmd} "${scan_args[@]}" 2> /dev/null | jq '.security = []' || true)"
+    ${cmd} "${scan_args[@]}" --output "$scan_output_file" > /dev/null 2>/dev/null || true
   else
-    KUBESCAPE_OUTPUT="$(${cmd} "${scan_args[@]}" | jq '.security = []' || true)"
+    ${cmd} "${scan_args[@]}" --output "$scan_output_file" > /dev/null || true
   fi
+  KUBESCAPE_OUTPUT="$(jq '.security = []' "$scan_output_file" 2>/dev/null || true)"
+  rm -f "$scan_output_file"
   if [[ -n "$KUBESCAPE_OUTPUT" ]]; then
     ! is_boolean_yes "$silent" && debug "Result:\n$KUBESCAPE_OUTPUT"
   else
@@ -170,7 +176,11 @@ kubescape_oss_assessment() {
     KUBESCAPE_IMAGE_OUTPUT=""
     info "Scanning image $((images_scanned + 1)) out of ${#unique_matching_images[@]}: ${image}"
     for ((i = 1; i <= retries; i += 1)); do
-      KUBESCAPE_IMAGE_OUTPUT="$(${cmd} "${scan_image_args[@]}" "${image}" 2> /dev/null || echo '')"
+      local image_output_file
+      image_output_file="$(mktemp --suffix=.json)"
+      ${cmd} "${scan_image_args[@]}" "${image}" --output "$image_output_file" > /dev/null 2>/dev/null || true
+      KUBESCAPE_IMAGE_OUTPUT="$(cat "$image_output_file" 2>/dev/null)"
+      rm -f "$image_output_file"
       if [[ -n "$KUBESCAPE_IMAGE_OUTPUT" ]]; then
         debug "Result: $KUBESCAPE_IMAGE_OUTPUT"
         break