Upgrade Notes
- Replace the binary or container image and restart running Pipelock processes to apply these fixes. This patch retains the 3.7 configuration format and Go module path.
- Receipt verification now refuses success when a required seal is missing. Preserve complete recorder directories when copying or archiving receipts.
Added
- No new product features; this release backports security fixes to 3.7.0.
Fixed
- Build release binaries and published container images with Go 1.26.10, and the source Dockerfile with Go 1.27.3, including the standard-library security fixes for GO-2026-6809.
- Retain response-scanning findings when Browser Shield rewrites a response.
- Detect built-in card patterns followed by another numeric field, while preserving custom-rule matching.
- Apply SSRF checks to supported IPv4 addresses embedded in IPv6 destinations.
- Preserve case-insensitive matching for bundled injection rules and detect additional encoded credential forms.
- Require recorded outgoing-request history before granting a server-issued ID allowance.
- Escape terminal control characters in approval prompts and affected command output.
- Avoid printing receipt verification success when a required seal is missing.
- Sign a block receipt when forward-proxy cross-request detection refuses a request, as the other transports already do.
- Preserve configured MCP scanning policy during setup discovery.
- Scan tool descriptions with separators preserved as word boundaries.
Changed
- Publish the GitHub release from
pipelab-org/pipelockwhile retainingghcr.io/luckypipewrenchimages and charts,luckyPipewrench/homebrew-tap, and the existing Go module path.