Portwing deployment guidance: For new deployments, use the latest supported Portwing v1.x release, currently v1.2.1. Portwing's published security policy maintains the 1.2.x line; 1.1.x and 1.0.x are unsupported. Portwing v1.0.1 fixed Standard enrollment when authorized_keys is writable but its parent directory isn't. Managed storage and the documented mode-specific rotation configuration/capabilities remain required.
v1.8.0-rc.15
Full Changelog: v1.8.0-rc.14...v1.8.0-rc.15
[1.8.0-rc.15] - 2026-11-13
Warning
Release candidate for opt-in testing. SQLite changes the on-disk store. Stop Drydock and back up the complete store directory before upgrading from v1.7 or earlier. First startup imports existing JSON data into SQLite. Downgrading requires restoring the intended pre-upgrade JSON snapshot and any separate session file; changes made only in SQLite are not carried back. A fresh v1.8 installation has no pre-upgrade JSON snapshot. Start with a copy of your store and test containers.
This candidate includes every rc.14 change and upgrade warning. It patches the Git dependency, fixes Portwing ownership and digest-event handling, and incorporates reviewed dependency and build updates. Its soak starts when this candidate is published.
Fixed
- Newly discovered Portwing containers retain their owning agent, so updates select the agent's Docker action instead of looking for a controller-local action (#1583).
- Portwing added and updated events refresh image details before digest comparison. They use the running image ID even if its local tag moved, retain a prior digest verdict only for the same image reference when refresh fails, and clear old update results and local candidate-age markers after an image change (#1584).
- The existing Docker watcher's Swarm service-label inheritance also applies during Portwing event refreshes. A failed service inspection preserves the prior digest verdict instead of replacing it with a result based on missing service labels.
- Correct the current Portwing rotation compatibility notes against its published v1.2.0 guide. Stable Portwing v1.x from v1.0 supports the documented opt-in pairing with the Drydock v1.8 candidates; managed storage and mode-specific configuration/capabilities remain required.
Security
- Pin Git to
2.54.1-r0, replacing the affected2.54.0in rc.14 and addressing CVE-2026-105437 and CVE-2026-111760. - Update fast-xml-parser to
5.12.0and remove the temporary CVE-2026-126066 scanner waiver.
Build maintenance
- This candidate uses the available Alpine
tzdata=2026f-r0andzlib=1.4-r0pins after the old exact revisions left the repository. Previously published candidates are unchanged. - Record the artifact-verified CVE-2026-4738 non-applicability for exactly
zlib@1.3.2-r1in OpenVEX. Other packages and CVEs remain gated at the existing severity cutoff. - Refresh reviewed runtime and development dependencies, Playwright 1.65.0 and its matching browser image, and verified GitHub Action pins. Keep the standalone OpenTelemetry Core 3 override out until its SDK/exporter graph is upgraded together.
- Update the German agent labels for operating system and live status.