Release v1.17.1

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file. This
 project adheres to [Semantic Versioning](http://semver.org/).
 
+## 1.17.1
+
+This release uses the latest version of Go (1.26.4) to build OPA, fixing stdlib vulnerabilities in
+code that OPA's HTTP handler and crypto builtins use:
+
+- https://pkg.go.dev/vuln/GO-2026-5039
+- https://pkg.go.dev/vuln/GO-2026-5037
+
+It is otherwise the same code as v1.17.0.
+
+Note that users building their own OPA binaries and images already control the Golang
+version, so this is not relevant for them.
+
+### Miscellaneous
+
+- build: bump go 1.26.3 -> 1.26.4 (authored by @srenatus)
+
 ## 1.17.0
 
 This release contains a mix of new features, performance improvements, and bugfixes.  Notably:

v1/version/version.go

@@ -10,7 +10,7 @@ import (
 	"runtime/debug"
 )
 
-var Version = "1.17.0"
+var Version = "1.17.1"
 
 // GoVersion is the version of Go this was built with
 var GoVersion = runtime.Version()