v1.7.1-rc.5

Full Changelog: v1.7.1-rc.4...v1.7.1-rc.5

[1.7.1-rc.5] — 2026-11-01

This is the fifth release candidate for the 1.7.1 maintenance release. It includes all rc.4 changes and redacts env values under *_KEY names such as ENCRYPTION_KEY (#1523). It is opt-in testing: v1.7.0 remains the stable release, and latest and the 1.7 channel do not move. This candidate starts a new seven-day soak at publication.

Security

• Env values under names with a standalone KEY segment (ENCRYPTION_KEY, LITELLM_MASTER_KEY, LITELLM_SALT_KEY) are now redacted in the container store and in GET /containers (#1523). The CLIENTKEY, SIGNINGKEY and ACCESSKEY compound names are covered too. Names like MONKEY and KEYBOARD_LAYOUT are unaffected. The startup scrub runs on every start, so stores cleaned by rc.4 are cleaned again for the new names on the first start after upgrading, and startup logs Redacted N sensitive env values in M containers when it changes anything (counts only). Backups and copies of the store made before the upgrade are not scrubbed. Redaction goes by variable name, so a secret under a name Drydock doesn't recognize can still be stored as plaintext.

Fixed

• The env value reveal button and the login password toggle no longer render blank: the eye icon was missing from the icon map (#1523).

Note: this is a maintenance cut, built from dev/v1.7 at 2c884713f20bae4cd6ec921641768802244ebfda, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.