v1.7.1-rc.2

Full Changelog: v1.7.1-rc.1...v1.7.1-rc.2

[1.7.1-rc.2] — 2026-10-26

This is the second release candidate for the 1.7.1 maintenance release on the 1.7 line. It is opt-in testing: v1.7.0 remains the stable release, and latest and the 1.7 channel do not move. It includes all of the rc.1 changes and pins libcurl to 8.23.0-r0 for CVE-2026-92392 (high), along with the npm advisory updates below.

Security

• Pin libcurl to 8.23.0-r0 in the image. The 8.22.0-r0 that git pulled in carries CVE-2026-92392 (high); v1.7.0 and v1.7.1-rc.1 shipped with it.
• Update body-parser to 2.4.0, fast-uri to 4.2.3, Nodemailer to 10.1.4 and Undici to 8.12.2 (7.30.1 in UI and E2E tooling). Patch Zod to 4.6.6 in backend/UI tooling and the docs site and serialize-javascript to 7.1.3 in UI tooling. These updates clear the October 24 advisory scan without changing its severity gate.

Note: this is a maintenance cut, built from dev/v1.7 at 0ef6231d3b98b268da0f8ca8e35e085be454681c, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.