v0.10.2

Features

• Added Vulnerability Policy Generator Skill for automated CVE analysis and mitigation policy generation (#329)
• Added startup GC to reclaim orphaned BPF map entries on agent restart (#333)
• Added bpf_loop BPF variant, raising mount-rule capacity to 64 on kernel >= 5.17 (#334)

Security Fixes

• Fixed YAML injection vulnerability in NetworkProxy profile renderer — user-controlled CRD fields were interpolated into Envoy xDS YAML without escaping (#331)
• Restricted Envoy admin interface from 0.0.0.0 to 127.0.0.1, preventing cross-pod access to sensitive endpoints (#331)
• Switched readiness probe from httpGet to tcpSocket to remove dependency on external admin access (#331)

Bug Fixes

• Fixed BPF map entry leaks that caused E2BIG errors on high-density nodes (#333)
• Fixed incorrect mount rule struct layout mismatching the kernel-side C struct (#334)
• Added pre-validation bounds checks for process, network, and mount rules (#334)

Refactors

• Upgraded Go to 1.25 and dependencies (#335)
• Updated vArmor-ebpf module for Linux kernel 6.6+ compatibility (#331)
• Updated Mozilla CA bundle (#331)
• Upgraded Node.js packages (#330, #331)
• Raised file/process/network inner-map capacity from 50 to 64 (#334)
• Improved error context in applyProfile with function names and rule counts (#334)

Docs

• Added arm64 requirement documentation for the BPF enforcer (#332)
• Overhauled AGENTS.md with security considerations, build/test commands, and code style guidelines (#331)
• Added Vulnerability Policy Generator guide under Policy Tools (#329)
• Fixed blog hyperlink and typo (#327, #328)

Acknowledgments

• 重明鸟 reported the YAML injection issue in the NetworkProxy profile renderer (#331)

Full Changelog: v0.10.1...v0.10.2