v1.6.1-rc.11

Full Changelog: v1.7.0-rc.13...v1.6.1-rc.11

[1.6.1-rc.11] — 2026-09-08

Monthly and longer watcher schedules could expire scans after 1 ms. The scan deadline was twice the cron interval, which overflowed Node's timer limit and cleared the in-flight scan guard almost immediately. Deadlines now stop at the largest supported delay, preserving the existing ten-minute floor and shorter schedule behavior.
Containers on a floating tag that drydock first saw before v1.5.0-rc.17 could stay marked Current forever, even when the registry had a newer digest. image.digest.watch was written once at first discovery and never revisited, so a row discovered before the digest-watch default changed from !isDockerHubDomain(domain) to "watch when the tag is meaningful" (v1.5.0-rc.17) kept the old false default permanently; only recreating the container picked up the new one. It is now re-derived every scan, the same way isLocalImage and digest.repoDigests already are, and an explicit dd.watch.digest label or imgset override still wins. Ported from the v1.7 line (#1108). (#1070)

Note: this is a maintenance cut, built from dev/v1.6 at 2bebb22dac2930b1fdf563b46be5c59243a6969f, not from main.

The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.