ko

v0.19.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Deployment Automation

✓ No known CVEs patched

This release patches 1 known CVE

Topics

container containers deploy docker go kubernetes

Affected surfaces

rce_ssrf

Summary

AI summary

Reject -toolexec in GOFLAGS to mitigate a security risk.

Full changelog

Add repeatable --ldflags flag for go build by @imjasonh in https://github.com/ko-build/ko/pull/1680
fix: apply defaultFlags before flag manipulation in .ko.yaml by @mateenali66 in https://github.com/ko-build/ko/pull/1612
fix: write directory headers in kodata tar archives by @0xiso in https://github.com/ko-build/ko/pull/1604
security: reject -toolexec in GOFLAGS environment variable by @mohammadmseet-hue in https://github.com/ko-build/ko/pull/1618
build: prevent kodata symlinks from escaping the kodata root by @evilgensec in https://github.com/ko-build/ko/pull/1619
fix: correct --sbom-dir flag description (file → directory) by @immanuwell in https://github.com/ko-build/ko/pull/1648

@ajayk made their first contribution in https://github.com/ko-build/ko/pull/1606
@mateenali66 made their first contribution in https://github.com/ko-build/ko/pull/1612
@mohammadmseet-hue made their first contribution in https://github.com/ko-build/ko/pull/1618
@alexandear made their first contribution in https://github.com/ko-build/ko/pull/1621
@evilgensec made their first contribution in https://github.com/ko-build/ko/pull/1619
@immanuwell made their first contribution in https://github.com/ko-build/ko/pull/1648
@SebTardif made their first contribution in https://github.com/ko-build/ko/pull/1664

Full Changelog: https://github.com/ko-build/ko/compare/v0.18.1...v0.19.0

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ko

Get notified when new releases ship.

About ko

Build and deploy Go applications