drivenets / kne / 23111509329

Pull #17

github

Security fixes, Azure annotation guard, and version command

- Bump Go from 1.25.0 to 1.25.8 (fixes 8 stdlib CVEs in crypto/tls,
  crypto/x509, net/url, html/template, os)
- Bump go.opentelemetry.io/otel/sdk from v1.36.0 to v1.40.0
  (fixes CVE-2026-24051 HIGH: arbitrary code execution via PATH hijacking)
- Fix directory permissions: 0666/os.ModePerm -> 0750 in deploy/deploy.go
  and topo/node/node.go
- Harden Dockerfiles: pin base images, add non-root USER, use
  --no-install-recommends, multi-stage distroless build for wire/forward
  and webhook
- Only apply Azure LB annotations on AKS clusters (was unconditional,
  causing unnecessary 10-min polling on non-Azure setups)
- Add 'kne version' subcommand with git commit/tag injected via ldflags
- Update CI: Go 1.25, migrate golangci-lint config to v2 format

Made-with: Cursor

2 of 19 new or added lines in 5 files covered. (10.53%)

4858 of 12317 relevant lines covered (39.44%)

0.45 hits per line