v1.6.1-rc.1

v1.6.1-rc.1

Full Changelog: v1.7.0-rc.2...v1.6.1-rc.1

[1.6.1-rc.1] — 2026-08-21

Fixed

• Drydock no longer reports "Up to date" when an update check failed. A registry error while verifying a candidate's digest discarded the newer tag that had already been found, and the UI presented the result as a confirmed "no update available." A check that could not complete now surfaces as an explicitly unknown status instead of a negative answer. This also covers transient registry failures reported separately. (#814, #808)
• Nested OCI image indexes now resolve to the real image manifest. An image whose per-platform entry is itself an index, which is what Buildx produces when SBOM or provenance attestations are enabled, failed with Unexpected error; no manifest found and left the container unable to complete a digest check. Drydock now follows the nested index to the platform's actual manifest, bounded to three levels, and correctly ignores the attestation manifest alongside it. (#814)
• A single malformed container no longer zeroes out an entire agent inventory sync. AgentClient.processAuthoritativeContainers() — the loop driving both the standard-mode handshake (_doHandshake(), every initial load and reconnect) and edge-mode handleContainerSync() (every dd:container_sync frame) — had no per-container error isolation, unlike the sibling SSE watcher-snapshot path. One container that threw while building its report (for example, during controller-side SBOM document offload) aborted the whole batch before any container reached the store, so a single bad container could make an otherwise-healthy fleet's inventory sync silently report zero containers. Each container in the batch is now processed independently, matching the existing isolation pattern in handleWatcherSnapshotEvent(): a failure is logged with the container id and the batch continues with the rest. A batch where every container fails now also logs a single proportionate warning, since a silently empty result was what let this go unnoticed for a release cycle. Found while investigating #802; this closes the isolation gap but does not confirm the SBOM path as that issue's trigger — Portwing does not currently send security.sbom on its container wire format, so #802 remains open pending its actual root cause.

---

Note: this is a maintenance cut, built from dev/v1.6 at 9d5b7da896b73861ed1a10fb5c8d0104014af478, not from main.

• The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.