v1.6.1-rc.10

Full Changelog: v1.7.0-rc.11...v1.6.1-rc.10

[1.6.1-rc.10] — 2026-09-06

Fixed

• The demo site did not send Cross-Origin-Opener-Policy, so the weekly DAST scan failed on ZAP rule 90004 every run. apps/demo/vercel.json now sends same-origin.
• The arm64 pass of the image arch check failed on every multi-platform cut with docker: cannot overwrite digest sha256:<index>. scripts/check-image-arch.sh ran once per platform against the same index-digest reference (ghcr.io/codeswhat/drydock:release-staging-N@sha256:<index>), and docker's classic image store cannot hold two platform variants under one digest, so the amd64 pass succeeded and the arm64 pass that followed it always failed. This killed the v1.6.1-rc.9 cut. The script now resolves each platform's own manifest digest out of the index via docker buildx imagetools inspect --raw and jq before it runs docker, skipping attestation entries, and falls back to running the reference unchanged when it isn't an index at all.
• DR-121: the session store and the main store wrote the same /store/dd.json, and whichever one saved last erased the other's data. express-session's connect-loki store opened its own independent LokiJS instance on the exact file the main store already used, and LokiJS's saveDatabase() always serializes the whole in-memory database, so a session autosave (every 5 seconds, and armed by nothing more than an authenticated request touching its session) reverted every container, setting, and audit row the main store had written since boot, while the main store's own autosave (every 5 minutes) deleted the Sessions collection out from under active logins. In practice this meant containers or settings written after startup could vanish from dd.json after a crash or a hard stop, and a restart could log every user out. The session store now writes to its own sibling file, dd-sessions.json by default (derived from DD_STORE_FILE, so a custom filename still gets a distinct sibling rather than colliding with anything else on the volume), and the main store drops and logs a stale Sessions collection left behind in dd.json by an older build instead of continuing to re-save it. Backups remain scoped to the main store file; sessions are not included and are expected to be dropped on restore, which just logs everyone out rather than corrupting anything.

Note: this is a maintenance cut, built from dev/v1.6 at 93f0477218fd7fdbe4b39c0a86e1b07d40f2ee15, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.