fix(plugins): needs-restarting kernel-mismatch line on Debian

The Debian branch of the plugin parses `needrestart -b` output and
tries to print a "Running Kernel X != Installed Kernel Y" line when
the currently running kernel does not match the installed one.

The comparison variables `kcur` and `kexp` were being reset to empty
strings on every iteration of the parse loop, so by the time the
`if kcur != kexp:` check ran (outside the loop, at function scope)
both variables held the last iteration's reset value - two empty
strings, which are never "not equal". The kernel-mismatch line was
therefore never printed, even though a pending kernel upgrade was
correctly reported as WARN via `NEEDRESTART-KSTA: 3`.

Move the initialization out of the loop so the values set during
parsing survive, and extend the fixture-based unit test to assert
the "Running Kernel ... != Installed Kernel ..." line shows up for
the debian-kernel-pending case.

Author: markuslf

CHANGELOG.md

@@ -147,6 +147,7 @@ Monitoring Plugins:
 * logfile: fix `OverflowError` when inode exceeds SQLite INTEGER range on Windows/NTFS ([#1035](https://github.com/Linuxfabrik/monitoring-plugins/issues/1035))
 * mysql-memory: fix a crash in the "other process memory" calculation on hosts running psutil older than 5.3.0 ([#1070](https://github.com/Linuxfabrik/monitoring-plugins/issues/1070))
 * mysql-table-locks: fix the "X immediate / Y locks" summary - the "Y" value now correctly shows the total lock count (immediate + waited) instead of the immediate count twice ([#1070](https://github.com/Linuxfabrik/monitoring-plugins/issues/1070))
+* needs-restarting: show the "Running Kernel X != Installed Kernel Y" line on Debian-based systems when `needrestart` reports a pending kernel upgrade. The kernel-version comparison variables were reset inside the parse loop, so the running-vs-installed kernel mismatch was never printed
 * network-connections: the plugin now exits with the correct WARN/CRIT state when any threshold is violated; previously it always reported OK regardless of the loop's accumulated state ([#1070](https://github.com/Linuxfabrik/monitoring-plugins/issues/1070))
 * nextcloud-security-scan: only trigger a rescan for scans that are actually in the past; future-dated scans caused by clock skew no longer trigger an unnecessary rescan ([#1070](https://github.com/Linuxfabrik/monitoring-plugins/issues/1070))
 * ntp-\*: prevent `TypeError: ''=' not supported between instances of 'int' and 'str'`

check-plugins/needs-restarting/needs-restarting

@@ -23,7 +23,7 @@ import lib.txt
 from lib.globals import STATE_OK, STATE_UNKNOWN, STATE_WARN
 
 __author__ = 'Linuxfabrik GmbH, Zurich/Switzerland'
-__version__ = '2026041202'
+__version__ = '2026041203'
 
 DESCRIPTION = """Checks for processes that were started before they or one of their dependencies were
 updated. Returns WARN if a full system reboot is required or if individual services
@@ -143,8 +143,8 @@ def main():
             msg = ''
             svc = 0
             svcs = ''
+            kcur, kexp = '', ''
             for line in stdout.split('\n'):
-                kcur, kexp = '', ''
                 if line.startswith('NEEDRESTART-KCUR: '):
                     kcur = line.replace('NEEDRESTART-KCUR: ', '')
                 if line.startswith('NEEDRESTART-KEXP: '):

check-plugins/needs-restarting/unit-test/run

@@ -62,7 +62,11 @@ TESTS = [
         'test': 'stdout/debian-kernel-pending,,0',
         'params': '--test-os-family=Debian',
         'assert-retc': STATE_WARN,
-        'assert-in': ['sshd.service', 'Version upgrade pending'],
+        'assert-in': [
+            'sshd.service',
+            'Version upgrade pending',
+            'Running Kernel 6.1.0-13-amd64 != Installed Kernel 6.1.0-15-amd64',
+        ],
     },
     {
         'id': 'unknown-os-not-supported',