drivenets / kne

39%

main: 39%

LAST BUILD ON BRANCH security-fixes-and-version

branch: security-fixes-and-version

CHANGE BRANCH

x

Reset

Sync Branches

• security-fixes-and-version
• add-node-selector-only
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• fix/exclude-eth0-from-interface-count
• main
• marco/add_azure_lb_annotations
• marco/add_node_selector
• marco/delete_wait
• marco/support_mcdnos_model
• marco/update_cdnos_manifest

Build # 23111509329

Build Type

Pull #17

github

Committed by msupinodn

Commit Message

Security fixes, Azure annotation guard, and version command

- Bump Go from 1.25.0 to 1.25.8 (fixes 8 stdlib CVEs in crypto/tls,
  crypto/x509, net/url, html/template, os)
- Bump go.opentelemetry.io/otel/sdk from v1.36.0 to v1.40.0
  (fixes CVE-2026-24051 HIGH: arbitrary code execution via PATH hijacking)
- Fix directory permissions: 0666/os.ModePerm -> 0750 in deploy/deploy.go
  and topo/node/node.go
- Harden Dockerfiles: pin base images, add non-root USER, use
  --no-install-recommends, multi-stage distroless build for wire/forward
  and webhook
- Only apply Azure LB annotations on AKS clusters (was unconditional,
  causing unnecessary 10-min polling on non-Azure setups)
- Add 'kne version' subcommand with git commit/tag injected via ldflags
- Update CI: Go 1.25, migrate golangci-lint config to v2 format

Made-with: Cursor

Pull Request Pull Request #17: Security fixes, Azure annotation guard, and version command

Run Details

2 of 19 new or added lines in 5 files covered. (10.53%)

1 existing line in 1 file now uncovered.

4858 of 12317 relevant lines covered (39.44%)

0.45 hits per line