# 3.7.1

**Release Date:** June 8, 2026

---

## 🐛 Bug Fixes

### Terraform Modules

#### Restore SP Key Vault Secrets User on OTEL Header Secrets 🔒

**Module:** `saif-resources`

**Commit:** [`90c03b79`](https://github.com/saif-corp/forge/commit/90c03b79)

Restores the `Key Vault Secrets User` role assignment for the service principal (SP) on OTEL header secrets, alongside the existing user-assigned managed identity (UAMI) assignment. [#742](https://github.com/saif-corp/forge/pull/742) (shipped in 3.7.0) switched the assignment from SP to UAMI to fix web services — but inadvertently broke API and event-subscriber services, which resolve OTEL headers from App Configuration at runtime using the SP identity.

Both identities now receive the role for all service types:

- **UAMI** — used by App Service to resolve `@Microsoft.KeyVault()` app settings (web services)
- **Service Principal** — used by the .NET runtime to resolve Key Vault references within App Configuration entries (API and event-subscriber services)

**Affected services:** `saif-api-service`, `saif-api-exp`, `saif-api-proc`, `saif-api-sys`, `saif-event-subscriber-service`

---

#### Revert Deployed-By Tag Sanitization ↩️

**Commit:** [`c545312e`](https://github.com/saif-corp/forge/commit/c545312e)

Reverts [#744](https://github.com/saif-corp/forge/pull/744) which attempted to sanitize the `deployed_by` Azure tag to strip parentheses from Dependabot build identities. The sanitization introduced unintended side effects and has been rolled back while a safer approach is evaluated.

---

### Documentation

#### Escape C# in Markdown Headers 📝

**Commit:** [`f75c98c5`](https://github.com/saif-corp/forge/commit/f75c98c5)

Escapes `C#` in markdown headers to prevent rendering issues in MkDocs.

---

## 📚 Documentation

### NuGet Feed URL Migration 🔗

**Commit:** [`66c9d1b0`](https://github.com/saif-corp/forge/commit/66c9d1b0)

Replaces `tfs.saif.com` NuGet feed URLs with `dev.azure.com` across all documentation. Ensures package references remain valid as the internal TFS hostname is retired.

---

### Developer Control Plane Diagram Update 🗺️

**Commit:** [`0222ebe6`](https://github.com/saif-corp/forge/commit/0222ebe6)

Improves the Developer Control Plane layout in the forge-services architecture diagram for clarity.

---

## 📦 Dependencies

| Package | From | To | PR |
|---------|------|----|----|
| ADO Client Libraries | 16.205.3 | 20.256.2 | [`4223e787`](https://github.com/saif-corp/forge/commit/4223e787) |

---

## 🔄 Breaking Changes

None in this release ✅

---

## 📋 Additional Notes

- Total commits: 9
- Contributors: Emmitt Johnson, Brian Sheridan, Copilot

---

### Support

- 📧 Teams Support Channel: [Support](https://teams.microsoft.com/l/channel/19%3Acb611810fb0b42b080cfff5590bdd51c%40thread.tacv2/Support?groupId=514d2dac-2d62-48ce-bf99-0fa0ce39469c&tenantId=a86cb8ed-369b-4df5-ace5-43811f6e08cf)

---