release: v7.0.1

[Suneha Bose (bosesuneha)]

Summary

Cuts v7.0.1 of Azure/k8s-deploy. Merging this PR triggers release-pr.yml, which tags v7.0.1, moves the v7 major tag, and publishes the GitHub Release.

Patch release: fixes, one security fix, docs, and dependency bumps. No breaking changes, no new features, so the v7 major tag moves safely for existing consumers.

Security

#560 — command injection in az aks command invoke. PrivateKubectl.execute flattened its argv array with args.join(' ') and passed the result to az aks command invoke --command. The run-command pod uses its own high-privilege service account, so this escaped whatever RBAC the workflow's kubeconfig was scoped to.

Values that reached the command string unescaped:

• manifest metadata.name, via the temp filename passed to -f
• the namespace input, which workflows commonly build from github.head_ref (git permits ;, $, `, |, & in branch names)
• the workflow annotation payload — unescaped JSON with spaces and double quotes

What's included since v7.0.0

8 commits.

PR	Type	Summary
#560	Security	POSIX-quote argv for az aks command invoke; honour silent; drop unused minimist
#543	Fixed	Strip trailing colon from parsed NewReplicaSet name
#555	Docs	Require k8s-bake v4.1.1+ in the bake example
#547, #548, #550, #551, #552	Dependencies	dependabot bumps (js-yaml, postcss, actions groups)

File changes

• CHANGELOG.md — new [7.0.1] entry, formatted to match prior entries
• package.json + package-lock.json — 7.0.0 → 7.0.1

README.md already references @v7, so no doc bump is needed for a patch. lib/ is gitignored and built at release time.

[David Gamero (davidgamero)]

lgtm