v1.7.1

Full Changelog: v1.7.1-rc.7...v1.7.1

[1.7.1] - 2026-11-11

This maintenance release promotes the exact signed v1.7.1-rc.7 image and source archive. It includes the fixes tested throughout the 1.7.1 candidate series. The application changes completed their soak in rc.5; rc.7 adds the Expat and Git security fixes, the available timezone package and scanner metadata. The owner approved shortening rc.7's additional soak to deliver the security fix. The published release records the candidate's exact age and the override reason.

Security

• Git 2.54.1-r0 fixes the newly published merge and import advisories, including CVE-2026-105437. The vulnerable Git package in rc.6 is replaced before GA.
• Redact recognized secret environment values and credential-bearing URLs before storing container records or update snapshots. Startup scrubs the existing JSON store, including names such as ENCRYPTION_KEY. This is name-based redaction, not encryption: unrecognized names can still retain plaintext, and old backups are not scrubbed. Environment reveal reads the live container; upgrade traditional agents alongside the controller (#1523).
• Update the Node.js runtime and vulnerable application dependencies carried through rc.2 to rc.4. The image includes libexpat 2.10.0-r0 for CVE-2026-113351, CVE-2026-115506, CVE-2026-117610 and CVE-2026-118370, plus the libcurl security fix.
• Record CVE-2026-4738 as not affected only for the inspected custom zlib APK. Optional infback9 code is absent; the existing gzip-write backport and scan thresholds are preserved.

Fixed

• Keep anonymous volumes and recreate containers that depend on a replaced container's network namespace or volumes. Update services defined in Compose include: files.
• Prevent include-filter recovery from offering older versions as updates (#1499), and recognize locally built images with Docker's containerd image store (#1506).
• Complete dependency views and update guards, show maturity countdowns across update lists, restore environment/password reveal icons, and finish the candidate series' UI translation and scanner consistency fixes.

Upgrade notes

• Use codeswhat/drydock:1.7.1 for an exact version. Stable channels 1.7, 1 and latest move to this image. The image's build identity remains 1.7.1-rc.7 because GA reuses the tested bytes.
• Back up the store before upgrading. This release keeps the 1.7 JSON store; the SQLite migration belongs to 1.8. Review the earlier candidate entries below for the complete changes, including maintenance-window scope (scan remains the 1.7 default), API route deprecations and dashboard additions.

Note: the standard seven-day release-candidate soak was shortened for this release.

• Candidate age at promotion: 708s (~0.0 days), short of the usual 7 days (604800s).
• Reason: Owner-approved security promotion: rc.5 application changes completed their seven-day soak. rc.7 retains that application code and fixes Git CVE-2026-105437 with Git 2.54.1-r0 while retaining the Expat 2.10.0-r0 security fixes. Required checks, fresh image scanning, published signatures, exact source reproduction and three-registry digest equality were verified before promotion. Promote these exact bytes to deliver the security fixes without another week.

Note: this is a maintenance cut, built from dev/v1.7 at f81d55984c843a930775e9a8719121612ec636ba, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.