v1.7.1-rc.6

Full Changelog: v1.7.1-rc.5...v1.7.1-rc.6

[1.7.1-rc.6] - 2026-11-10

This security release candidate replaces rc.5. It retains rc.5's application changes and rebuilds with the retained branch's libexpat 2.10.0-r0 fix. It is opt-in testing; v1.7.0 remains stable and the stable channels do not move. A new seven-day soak starts at publication.

Security

• libexpat is pinned to 2.10.0-r0, which fixes CVE-2026-113351, CVE-2026-115506, CVE-2026-117610 and CVE-2026-118370. rc.5 contains 2.9.0-r0 and cannot be promoted as the patched image.
• Add an OpenVEX not-affected statement for CVE-2026-4738, scoped only to the custom zlib@1.3.2-r2026092401 APK. The optional vulnerable infback9 code is absent from the standard library build and inspected runtime artifacts. The separate gzip-write backport and all scan thresholds remain unchanged.

Fixed

• Restore Docker builds on both supported architectures: Alpine no longer serves the old exact libexpat or tzdata=2026e-r0 pins. The timezone package is pinned to the available 2026f-r0 revision.

Note: this is a maintenance cut, built from dev/v1.7 at 7e9d155fcd0fb7d390209d411a78867de19ade9b, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.