v1.7.1-rc.3

Full Changelog: v1.7.1-rc.2...v1.7.1-rc.3

[1.7.1-rc.3] — 2026-10-29

This is the third release candidate for the 1.7.1 maintenance release on the 1.7 line. It is opt-in testing: v1.7.0 remains the stable release, and latest and the 1.7 channel do not move. It includes all of the rc.2 changes, the vue-i18n fix for CVE-2026-118257 (high), and backports of the #1499 and #1506 fixes.

Security

• The image base is now Node.js 24.22.2 (from 24.20.0), which fixes the Node.js advisories Grype flagged in the bundled node binary, including the critical CVE-2026-111497.
• vue-i18n is now 11.4.16, which fixes CVE-2026-118257 (high) and CVE-2026-118256 in vue-i18n and @intlify. qs is now 6.16.1 for CVE-2026-110816 and re2js 2.8.7 for CVE-2026-116795, which drydock could not reach because it never enables lookbehinds. deepmerge 4.3.1 (CVE-2026-93753) has no fixed release and only runs at UI build time, so it is triaged with a recheck date.

Fixed

• A container whose tag no longer matches dd.tag.include is no longer offered older matching tags as updates. The best-effort recovery only offers a tag whose version is newer than the running one, so a nextcloud:30.0.17 container with dd.tag.include=^27\.\d+\.\d+$ stops getting a 27.x downgrade, approval and notification (#1499).
• Locally built images are now recognised as local under Docker's containerd image store, using the image identity Docker reports from API 1.53, so they skip registry lookups and stay in the UI (#1506).

Note: this is a maintenance cut, built from dev/v1.7 at cc8b2301e75ecb9679ef12d5edeb25dd867b6d40, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.