Azure/k8s-deploy v7.0.1

on GitHub

Security

• #560 Fix command injection in az aks command invoke for private clusters: argv is now POSIX-quoted instead of flattened with join(' '), so manifest resource names, the namespace input and the workflow annotation payload can no longer escape into the run-command pod's high-privilege service account
• #552 Bump js-yaml from 5.2.1 to 5.2.2
• #551 Bump postcss from 8.5.15 to 8.5.25
• #550 Bump js-yaml from 4.2.0 to 4.3.0
• #548 Bump the actions group across 1 directory with 6 updates
• #547 Bump the actions group across 1 directory with 5 updates

Fixed

• #543 Strip trailing colon from the parsed NewReplicaSet name in rollout status output
• #560 Honour the caller's silent flag in PrivateKubectl.execute; command output was previously written to the debug log unconditionally

Changed

• #560 Remove the unused minimist dependency
• #555 Document that the k8s-bake example requires k8s-bake v4.1.1+, which writes its baked manifest inside GITHUB_WORKSPACE