Pipeline Control Gateway v2.5.0

New features and improvements

• Upgraded the embedded OpenTelemetry Collector from v0.139.0 to v0.156.0, incorporating the latest upstream components and resolving several CVEs flagged by vulnerability scanning.
• Migrated the gateway runtime to a hardened distroless/Alpine base image, with Docker base images now pinned by digest for reproducible, tamper-resistant builds.
• Upgraded to Go 1.25 and refreshed the golang.org/x/crypto dependency.
• Updated metering to retain the first data point in each series.

Fixes

• Added nil-safety checks to prevent potential panics.
• Prevented an unintended overwrite of the trace_id string value.

Security updates

• The gateway container now runs as a non-root user (UID 65532) by default, reducing its privilege footprint.
• The gateway now listens on the unprivileged port 8080 instead of 80. The Kubernetes Service, ingress, and Gloo upstream definitions are all updated to match. If you reference the gateway service port directly, update it to 8080.
• The gateway now masks sensitive values, such as license keys and API keys, in the logs it emits.
• The gateway now fails fast when the license key is missing or invalid.
• Applied additional security hardening and dependency fixes.