v3.7.1

Upgrade Notes

• Replace the binary or container image and restart running Pipelock processes to apply these fixes. This patch retains the 3.7 configuration format and Go module path.
• Receipt verification now refuses success when a required seal is missing. Preserve complete recorder directories when copying or archiving receipts.

Added

• No new product features; this release backports security fixes to 3.7.0.

Fixed

• Build release binaries and published container images with Go 1.26.10, and the source Dockerfile with Go 1.27.3, including the standard-library security fixes for GO-2026-6809.
• Retain response-scanning findings when Browser Shield rewrites a response.
• Detect built-in card patterns followed by another numeric field, while preserving custom-rule matching.
• Apply SSRF checks to supported IPv4 addresses embedded in IPv6 destinations.
• Preserve case-insensitive matching for bundled injection rules and detect additional encoded credential forms.
• Require recorded outgoing-request history before granting a server-issued ID allowance.
• Escape terminal control characters in approval prompts and affected command output.
• Avoid printing receipt verification success when a required seal is missing.
• Sign a block receipt when forward-proxy cross-request detection refuses a request, as the other transports already do.
• Preserve configured MCP scanning policy during setup discovery.
• Scan tool descriptions with separators preserved as word boundaries.

Changed

• Publish the GitHub release from pipelab-org/pipelock while retaining ghcr.io/luckypipewrench images and charts, luckyPipewrench/homebrew-tap, and the existing Go module path.