v1.7.1-rc.7

Full Changelog: v1.7.1-rc.6...v1.7.1-rc.7

[1.7.1-rc.7] - 2026-11-11

This security candidate retains rc.6's application code and fixes the Git advisories published during its build. It is prepared for expedited 1.7.1 GA promotion under the owner-approved security soak override. Stable channels stay on 1.7.0 until GA is published.

Security

• Pin Git to 2.54.1-r0, including its matching init templates. This fixes CVE-2026-105437 (three-way merge heap overflow) and CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467 and CVE-2026-114469. rc.6 contains vulnerable Git2.54.0; administrator-defined Command actions can reach it when merging untrusted repositories. rc.6 is superseded and will not be promoted.
• Correct the exact-image rc.6 OpenVEX record to affected, with an action statement. A free-text exclusion for custom commands cannot narrow an image-wide not_affected assertion. No ignore rule or severity cutoff changes.
• Record the stop-node XML advisory's inspected configuration: the runtime caller leaves the non-default option disabled; the second dependency is E2E-only. Keep the classification limited to the two reviewed lockfiles, with version/configuration guards and an upgrade follow-up.

Note: this is a maintenance cut, built from dev/v1.7 at f81d55984c843a930775e9a8719121612ec636ba, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.