Bump dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Manager	Type	Update	Change
actions/checkout	github-actions	action	minor	v6.0.3 → v6.1.0
actions/setup-dotnet	github-actions	action	minor	v5.3.0 → v5.4.0
docker-buildx	regex	run	minor	0.34.1 → 0.36.1
docker-compose	regex	run	minor	5.1.4 → 5.5.0
docker/login-action	github-actions	action	minor	v4.2.0 → v4.6.0
docker/setup-buildx-action	github-actions	action	minor	v4.1.0 → v4.3.0
docker/setup-qemu-action	github-actions	action	minor	v4.1.0 → v4.2.0
dotnet-sdk	regex	script	patch	10.0.301 → 10.0.400
dotnet-sdk	regex	task	patch	10.0.301 → 10.0.400
dotnet-sdk	regex	action	patch	10.0.301 → 10.0.400
mcr.microsoft.com/dotnet/sdk	dockerfile	final	patch	10.0.301-resolute → 10.0.400-resolute

---

Release Notes

actions/checkout (actions/checkout)

v6.1.0

Compare Source

actions/setup-dotnet (actions/setup-dotnet)

v5.4.0

Compare Source

What's Changed

Enhancements

• Improve global.json SDK version validation for rollForward by @​priyagupta108 in #​742
• Pin actions to commit SHAs in workflows by @​priya-kinthali in #​744
• Expand the CSC problem matcher to light up more errors on GitHub. by @​StephenCleary in #​717

Documentation

• Docs(action): Explicitly mark all optional inputs with required: false by @​kranthipoturaju in #​737

Bug Fixes

• Fix global.json creation command by @​michal2612 in #​694

Dependency Updates

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​746

New Contributors

• @​jasongin made their first contribution in #​746
• @​michal2612 made their first contribution in #​694
• @​kranthipoturaju made their first contribution in #​737
• @​StephenCleary made their first contribution in #​717

Full Changelog: actions/setup-dotnet@v5...v5.4.0

docker/buildx (docker-buildx)

v0.36.1

Compare Source

Welcome to the v0.36.1 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax

Notable Changes

• Add BUILDX_NO_DEFAULT_OCI_ARTIFACT as alternative to oci-artifact=false when users have not set it explicitly. #​3991

Dependency Changes

• github.com/moby/buildkit v0.32.0 -> v0.32.2

Previous release can be found at v0.36.0

v0.36.0

Compare Source

Welcome to the v0.36.0 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax
• Tõnis Tiigi
• Sebastiaan van Stijn
• MohammadHasan Akbari
• Matt Van Horn
• amarkdotdev
• Areeb Ahmed
• Guillaume Lours
• Paweł Gronowski
• Pierre Gimalac
• s3onghyun

Notables Changes

• Default source policy can now validate the authenticity of BuildKit release images when creating docker-container builder with docker buildx create command. #​3961
• Bake command now supports overriding declared secret sources. #​3962
• Broken builder instances are now correctly handled on removal. #​3934
• Bake now supports resolving files relative to the bake file location instead of the current working directory with BUILDX_BAKE_FILE_RELATIVE_PATHS=true. #​3935
• Source policies now support new array.flatten builtin and OPA template strings. #​3913
• Imagetools commands now do extra validation of the descriptor inputs from files. #​3933
• Windows release binaries are now code-signed, matching the signing coverage already provided for macOS release artifacts. #​3978
• Compose compatibility has been updated to v2.13.0. #​3929
• Fix source policy support on Windows when loading local files inside policy. #​3944
• Fix Kubernetes driver random load balancer support. #​3861
• Fix Kubernetes driver builds hanging indefinitely when the remote exec stream ends. #​3966
• Fix iidfile for containerd-backed Docker driver. #​3952
• Fix authority pseudo-header when using remote driver. #​3928
• Fix possible FD leak when using source policies. #​3943

Dependency Changes

• github.com/Microsoft/go-winio v0.6.2 -> ad3df93
• github.com/ProtonMail/go-crypto v1.3.0 -> v1.4.1
• github.com/aws/aws-sdk-go-v2 v1.42.0 -> v1.43.0
• github.com/aws/aws-sdk-go-v2/config v1.32.24 -> v1.32.31
• github.com/aws/aws-sdk-go-v2/credentials v1.19.23 -> v1.19.30
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.29 -> v1.18.31
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 -> v1.4.31
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 -> v2.7.31
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.30 -> v1.4.32
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.12 -> v1.13.13
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.29 -> v1.13.31
• github.com/aws/aws-sdk-go-v2/service/signin v1.1.5 -> v1.5.0
• github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 -> v1.33.0
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.36.6 -> v1.38.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 -> v1.45.0
• github.com/aws/smithy-go v1.27.2 -> v1.27.4
• github.com/compose-spec/compose-go/v2 v2.10.2 -> v2.13.0
• github.com/containerd/containerd/api v1.10.0 -> v1.11.1
• github.com/containerd/containerd/v2 v2.2.4 -> v2.3.3
• github.com/containerd/ttrpc v1.2.8 -> v1.2.9
• github.com/docker/cli v29.5.3 -> v29.6.2
• github.com/go-openapi/errors v0.22.7 -> v0.22.8
• github.com/go-openapi/loads v0.23.3 -> v0.24.0
• github.com/go-openapi/runtime v0.32.3 -> v0.32.4
• github.com/go-openapi/spec v0.22.5 -> v0.22.6
• github.com/go-openapi/strfmt v0.26.3 -> v0.26.4
• github.com/go-openapi/swag v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/cmdutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/conv v0.26.0 -> v0.27.0
• github.com/go-openapi/swag/fileutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/jsonname v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/jsonutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/loading v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/mangling v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/netutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/stringutils v0.26.0 -> v0.26.1
• github.com/go-openapi/swag/typeutils v0.26.0 -> v0.27.0
• github.com/go-openapi/swag/yamlutils v0.26.0 -> v0.26.1
• github.com/go-openapi/validate v0.25.3 -> v0.26.0
• github.com/google/go-containerregistry v0.21.6 -> v0.21.7
• github.com/klauspost/compress v1.18.6 -> v1.19.1
• github.com/lestrrat-go/httprc/v3 v3.0.1 -> v3.0.2
• github.com/lestrrat-go/jwx/v3 v3.0.11 -> v3.0.13
• github.com/moby/buildkit v0.31.0 -> v0.32.0
• github.com/moby/go-archive v0.2.0 -> v0.2.1
• github.com/moby/moby/api v1.54.2 -> v1.55.0
• github.com/moby/moby/client v0.4.1 -> v0.5.0
• github.com/moby/policy-helpersd5411a9 -> 856be88
• github.com/moby/sys/user v0.4.0 -> v0.4.1
• github.com/open-policy-agent/opa v1.10.1 -> v1.14.1
• github.com/segmentio/asm v1.2.0 -> v1.2.1
• github.com/sigstore/rekor v1.5.2 -> v1.5.3
• github.com/sigstore/rekor-tiles/v25d098a2 -> v2.3.0
• github.com/sigstore/sigstore-go v1.2.1 -> v1.2.2
• github.com/tonistiigi/fsutil0257b33 -> 6d9dc2e
• github.com/valyala/fastjson v1.6.4 -> v1.6.7
• github.com/vektah/gqlparser/v2 v2.5.30 -> v2.5.32
• golang.org/x/crypto v0.52.0 -> v0.54.0
• golang.org/x/mod v0.36.0 -> v0.38.0
• golang.org/x/net v0.55.0 -> v0.57.0
• golang.org/x/sync v0.20.0 -> v0.22.0
• golang.org/x/sys v0.45.0 -> v0.47.0
• golang.org/x/term v0.43.0 -> v0.45.0
• golang.org/x/text v0.37.0 -> v0.40.0
• golang.org/x/tools v0.45.0 -> v0.47.0
• google.golang.org/grpc v1.81.1 -> v1.82.1
• google.golang.org/protobuf v1.36.11 -> f2248ac
• k8s.io/api v0.35.4 -> v0.36.0
• k8s.io/apimachinery v0.35.4 -> v0.36.0
• k8s.io/client-go v0.35.4 -> v0.36.0
• k8s.io/kube-openapi589584f -> 5883c5e
• k8s.io/streaming v0.36.0 new
• k8s.io/utilsbc988d5 -> 28399d8
• sigs.k8s.io/structured-merge-diff/v6 v6.3.0 -> v6.3.2

Previous release can be found at v0.35.0

v0.35.0

Compare Source

buildx 0.35.0

Welcome to the v0.35.0 release of buildx!

Please try out the release binaries and report any issues at
https://github.com/docker/buildx/issues.

Contributors

• CrazyMax
• Tõnis Tiigi
• Sebastiaan van Stijn
• Areeb Ahmed
• Jiří Moravčík
• Sopho Merkviladze
• Akihiro Suda
• Jonathan A. Sternberg

Notable Changes

• Local output now supports a mode=delete attribute for build and bake commands. This mode replaces the destination directory with the build result instead of merging it. Similar to the --delete flag in rsync. For safety, this mode is only allowed if the destination directory is a subdirectory of the working directory. To export to other destinations, --allow=buildx.local.delete needs to be provided or the action confirmed by the user in the TUI. When exporting multi-platform results, this mode requires BuildKit v0.31.0+. #​3883
• Source policies now support the new exec proxy feature of BuildKit v0.31.0+ that captures the network traffic of your build steps. To opt in to network proxy, your Dockerfile.rego source policy needs to return caps: { "exec.proxy": true } in the evaluation decision. After opting in, you can control what network requests are allowed to be made by the run steps with policy rules for regular input.http sources, similar to how this was done for direct HTTP build sources before. You can also opt in your whole builder with --buildkitd-flags '--proxy-network' in buildx create. #​3895
• Resource limits can now be set for CPU and memory using the --resource flag in build and the resource key in bake commands. This feature requires BuildKit v0.31.0+ and Dockerfile v1.25.0+. #​3876#​3900
• Fix possible "closed channel" panic. #​3886

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.41.7 -> v1.42.0
• github.com/aws/aws-sdk-go-v2/config v1.32.17 -> v1.32.24
• github.com/aws/aws-sdk-go-v2/credentials v1.19.16 -> v1.19.23
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 -> v1.18.29
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 -> v1.4.29
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 -> v2.7.29
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 -> v1.4.30
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 -> v1.13.12
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 -> v1.13.29
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 -> v1.1.5
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 -> v1.31.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 -> v1.36.6
• github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 -> v1.43.3
• github.com/aws/smithy-go v1.25.1 -> v1.27.2
• github.com/containerd/containerd/v2 v2.2.3 -> v2.2.4
• github.com/containerd/continuity v0.4.5 -> v0.5.0
• github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
• github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
• github.com/docker/cli v29.4.3 -> v29.5.3
• github.com/docker/distribution v2.8.3 new
• github.com/docker/docker-credential-helpers v0.9.5 -> v0.9.8
• github.com/go-openapi/analysis v0.24.3 -> v0.25.2
• github.com/go-openapi/jsonpointer v0.22.5 -> v0.23.1
• github.com/go-openapi/jsonreference v0.21.5 -> v0.21.6
• github.com/go-openapi/runtime v0.29.3 -> v0.32.3
• github.com/go-openapi/runtime/server-middleware v0.30.0 new
• github.com/go-openapi/spec v0.22.4 -> v0.22.5
• github.com/go-openapi/strfmt v0.26.1 -> v0.26.3
• github.com/go-openapi/swag v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/cmdutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/conv v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/fileutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/jsonname v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/jsonutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/loading v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/mangling v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/netutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/stringutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/typeutils v0.25.5 -> v0.26.0
• github.com/go-openapi/swag/yamlutils v0.25.5 -> v0.26.0
• github.com/go-openapi/validate v0.25.2 -> v0.25.3
• github.com/google/certificate-transparency-go v1.3.2 -> v1.3.3
• github.com/google/go-containerregistry v0.20.7 -> v0.21.6
• github.com/gorilla/mux v1.8.1 new
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 -> v2.29.0
• github.com/in-toto/attestation v1.1.2 -> v1.2.0
• github.com/moby/buildkit v0.30.0 -> v0.31.0
• github.com/moby/policy-helpersa39d601 -> d5411a9
• github.com/moby/sys/sequential v0.6.0 -> v0.7.0
• github.com/pelletier/go-toml/v2 v2.2.4 -> v2.3.1
• github.com/prometheus/common v0.66.1 -> v0.67.5
• github.com/prometheus/procfs v0.17.0 -> v0.20.1
• github.com/secure-systems-lab/go-securesystemslib v0.10.0 -> v0.11.0
• github.com/sigstore/protobuf-specs v0.5.0 -> v0.5.1
• github.com/sigstore/rekor v1.5.0 -> v1.5.2
• github.com/sigstore/rekor-tiles/v2 v2.0.1 -> 5d098a2
• github.com/sigstore/sigstore v1.10.5 -> v1.10.8
• github.com/sigstore/sigstore-go v1.1.4 -> v1.2.1
• github.com/sigstore/timestamp-authority/v2 v2.0.6 -> v2.1.2
• github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
• github.com/tonistiigi/fsutila2aa163 -> 0257b33
• github.com/transparency-dev/formats404c0d5 -> v0.1.1
• github.com/youmark/pkcs8a2c0da2new
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 -> v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 -> v0.69.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 -> v0.69.0
• go.opentelemetry.io/otel v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 -> v1.44.0
• go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
• go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
• google.golang.org/genproto/googleapis/api6f92a3b -> 3dc84a4
• google.golang.org/genproto/googleapis/rpc6f92a3b -> 3dc84a4
• google.golang.org/grpc v1.80.0 -> v1.81.1
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 -> v1.6.1
• k8s.io/klog/v2 v2.130.1 -> v2.140.0

Previous release can be found at v0.34.1

docker/compose (docker-compose)

v5.5.0

Compare Source

What's Changed

ℹ️ This release overhauls image digest reconciliation to prevent unnecessary container recreation.
Existing containers may be recreated the first time you run compose up after upgrading, as image digests are re-evaluated using the new logic.

compose pull now honors pull_policy refresh windows (daily, weekly, every_N).

✨ Improvements

• New image digest reconciliation process by @​glours & @​ndeloof#​14011#​14041

🐛 Fixes

• Fix(bridge): skip pulling default image references for build-only ser… by @​ericwyles in #​14010
• Fix(watch): stop pruning every dangling image of the project by @​glours in #​14012
• Fix(config): resolve service environment when computing --hash by @​glours in #​14002
• Fix(watch): skip unreadable directories instead of failing the watch by @​Endika in #​13992
• Fix: ignore one-off container events in up monitor by @​brano-osif in #​14038
• Fix(bridge): validate arguments of bridge subcommands by @​glours in #​14003
• Fix(images): tolerate containers whose image record is gone by @​ndeloof in #​14028

🔧 Internal

• Test: Set stop_signal to SIGTERM in nginx-based services by @​ricardobranco777 in #​13881
• Chore: inline needlessly extracted single-use helpers by @​ndeloof in #​14048
• Add ENGINE column driven by label by @​nicksieger in #​13959

⚙️ Dependencies

• Build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 by @​dependabot[bot] in #​13999
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​14009
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​14019
• Build(deps): bump github.com/moby/buildkit from 0.32.1 to 0.32.2 by @​dependabot[bot] in #​14033
• Build(deps): bump github.com/docker/buildx from 0.36.0 to 0.36.1 by @​dependabot[bot] in #​14034
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.15.0 to 1.16.0 in the docker-actions group by @​dependabot[bot] in #​14035
• Build(deps): bump github.com/moby/go-archive from 0.3.2 to 0.3.3 by @​dependabot[bot] in #​14043
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​14022
• Build(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.2+incompatible by @​dependabot[bot] in #​14042
• Build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in #​14008
• Bump golang to version 1.26.6 by @​glours in #​14045

New Contributors

• @​ericwyles made their first contribution in #​14010
• @​Endika made their first contribution in #​13992
• @​brano-osif made their first contribution in #​14038

Full Changelog: docker/compose@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

ℹ️ This release introduces a new way to reconcile resources such as volumes and networks

✨ Improvements

• Feat(reconcile): model volume recreation in the plan by @​ndeloof in #​13962
• Feat(reconcile): model network lifecycle in the plan by @​ndeloof in #​13966

🐛 Fixes

• Fix(reconcile): preserve zero-replica services during hashing by @​junhaoliao in #​13931
• Fix(config): warn when service selection is silently ignored by @​glours in #​13950
• Fix(build): use platform image-manifest digest, not attested index by @​glours in #​13949
• Fix(oci): honor --insecure-registry when up re-loads the model by @​ptrdom in #​13894
• Fix(config): pin type:image volume sources and pre_start hook images by @​glours in #​13956
• Tolerate missing env file on more runtime commands by @​maxproske in #​13603
• Resolve pre_start hook images alongside service images by @​ndeloof in #​13937
• Fix(cp): return non-nil Content from dry-run CopyFromContainer by @​glours in #​13982
• Fix(config): apply config flags to --services/--volumes/--networks/--models/--hash by @​glours in #​13979
• Fix: tolerate missing env file on scale, watch and shell completion by @​glours in #​13973

🔧 Internal

• README: remove Go Report Card badge by @​thaJeztah in #​13926
• Docs: adopt AGENTS.md standard, symlink CLAUDE.md to it by @​glours in #​13871
• Dockerfile: update golang image to alpine 3.23 by @​thaJeztah in #​13921
• Docs: require dated AI_AGENT_DISCLOSURE.md, drop committed copy by @​glours in #​13976
• CI: publish images to Docker Hub using OIDC by @​glours in #​13994

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @​dependabot[bot] in #​13942
• Build(deps): bump the docker-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​13941
• Build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​13943
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 by @​dependabot[bot] in #​13948
• Build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​13927
• Build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​13928
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0 in the docker-actions group by @​dependabot[bot] in #​13953
• Build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in #​13922
• Build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​13955
• Build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​13960
• Build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @​dependabot[bot] in #​13961
• Build(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible by @​dependabot[bot] in #​13968
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 by @​dependabot[bot] in #​13981
• Build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​13970
• Build(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 by @​dependabot[bot] in #​13969
• Bump compose-go to version v2.14.0 by @​glours in #​13983
• Bump go-archive to version v0.3.0 by @​glours in #​13986
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.14.0 to 1.15.0 in the docker-actions group by @​dependabot[bot] in #​13989
• Chore(deps): bump github.com/moby/go-archive v0.3.2 by @​thaJeztah in #​13991
• Update to go1.26.5 by @​thaJeztah in #​13920
• Build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​13996
• Build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.2 to 2.0.3 in the docker-actions group by @​dependabot[bot] in #​13995
• Build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​13984
• Chore(deps): github.com/docker/buildx v0.36.0, buildkit v0.32.0 by @​glours in #​13975
• Bump buildkit v0.32.1 by @​glours in #​13997

New Contributors

• @​junhaoliao made their first contribution in #​13931

Full Changelog: docker/compose@v5.3.1...v5.4.0

v5.3.1

Compare Source

What's Changed

🔧 Internal

• Ci: add concurrency group to pr-review-trigger to prevent duplicate reviews by @​derekmisler in #​13890
• Fix grammar in Attestations field comment by @​blackflytech in #​13891
• Ci: remove unused desktop-edge-test workflow by @​thaJeztah in #​13897
• Ci: zizmor workflow by @​crazy-max in #​13901
• Ci: fix docs-upstream workflow by @​crazy-max in #​13912
• CODEOWNERS: add compose-reviewers by @​thaJeztah in #​13913
• Ci: harden GitHub Actions workflows by @​glours in #​13896
• GHA: dependabot: group docker/* actions updates by @​thaJeztah in #​13914

⚙️ Dependencies

• Build(deps): bump github.com/moby/buildkit from 0.31.0 to 0.31.1 by @​dependabot[bot] in #​13892
• Build(deps): bump github.com/moby/sys/user to v0.4.1 by @​thaJeztah in #​13893
• Build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 by @​dependabot[bot] in #​13876
• Build(deps): bump github.com/docker/cli from 29.6.0+incompatible to 29.6.1+incompatible by @​dependabot[bot] in #​13895
• Build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​13902
• Build(deps): bump the docker-actions group with 3 updates by @​dependabot[bot] in #​13916
• Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​13908
• Build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 by @​dependabot[bot] in #​13907
• Build(deps): bump test-summary/action from 2.4 to 2.6 by @​dependabot[bot] in #​13903
• Build(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 by @​dependabot[bot] in #​13910
• Build(deps): bump codecov/codecov-action from 5.5.3 to 7.0.0 by @​dependabot[bot] in #​13904
• Build(deps): bump github/codeql-action/upload-sarif from 3.36.3 to 4.36.2 by @​dependabot[bot] in #​13917
• Build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @​dependabot[bot] in #​13911

New Contributors

• @​blackflytech made their first contribution in #​13891

Full Changelog: docker/compose@v5.3.0...v5.3.1

v5.3.0

Compare Source

What's Changed

ℹ️ This release introduces native support for init containers.

✨ Improvements

• Pre start init containers by @​glours in #​13862

🐛 Fixes

• Fix(oci): route authorizer token fetches through provided transport by @​glours in #​13873
• Fix(run): scope Running events to project.Services by @​glours in #​13883

🔧 Internal

• Chore: migrate cagent-action to docker-agent-action (v2.0.0) by @​docker-agent in #​13869
• Chore: migrate to docker-agent-action v2.0.1 by @​docker-agent in #​13872
• Fix(reconcile): hash resolved service refs to match executor by @​glours in #​13880
• Fix(compose/port): show private port in portNotFoundError message by @​vmphase in #​13875
• Fix(run): normalize --no-TTY flag to --no-tty by @​nickjj in #​13885

⚙️ Dependencies

• Bump compose-go to version v2.13.0 by @​glours in #​13886

New Contributors

• @​docker-agent made their first contribution in #​13869
• @​vmphase made their first contribution in #​13875
• @​nickjj made their first contribution in #​13885

Full Changelog: docker/compose@v5.2.0...v5.3.0

v5.2.0

Compare Source

What's Changed

ℹ️ This version introduces a new reconciliation algorithm between the observed state and the expected state.

If you experience any issues with a Compose workload that was previously working, please open an issue.

✨ Improvements

• Reconciliation plan by @​ndeloof & @​glours in #​13830
• Add rawsetenv message type for provider plugins by @​rajyan in #​13742

🐛 Fixes

• Fix(build): skip remote URL contexts from bake fs.read allowlist by @​ndeloof in #​13816
• Skip validation when extracting config variables by @​scarab-systems in #​13831
• Fix(progress): probe stderr (not stdout) for TTY auto-detection by @​glours in #​13837
• Fix(publish): honor env_file required: false for missing files by @​Ijtihed in #​13848

🔧 Internal

• Docs: compose logs: add links for since/until flag descriptions by @​thaJeztah in #​13806
• Ci: add Dependabot cooldown (2026060-170456) by @​securityeng-bot[bot] in #​13820
• Docs(CLAUDE.md): note that commits must be signed off (DCO) by @​ndeloof in #​13817
• Refactor: replace Split in loops with more efficient SplitSeq and replace HasPrefix+TrimPrefix with CutPrefix by @​caltechustc in #​13810
• Chore: fix some comments to improve readability by @​solunolab in #​13823
• GHA: update docs-upstream to pin workflows by sha by @​thaJeztah in #​13834
• Docs: compose logs: add more links for flag descriptions by @​thaJeztah in #​13833
• Fix/progress tty line overflow 13595 by @​glours in #​13840
• Fix(publish): bypass Docker Desktop proxy for loopback registries by @​ptrdom in #​13825
• Watch: do not rebuild depends_on services on file change by @​ndeloof in #​13856
• pkg/e2e: fix malformed JWT in fixtures by @​thaJeztah in #​13857
• pkg/e2e: drop unused run param from getEnv by @​glours in #​13867
• Docs: ps --format json outputs JSON Lines, not a JSON array by @​glours in #​13868

⚙️ Dependencies

• Build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible by @​dependabot[bot] in #​13802
• Update to go 1.26.4 by @​thaJeztah in #​13828
• Chore(deps): github.com/containerd/typeurl/v2 v2.3.0 by @​thaJeztah in #​13829
• Build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by @​dependabot[bot] in #​13838
• Chore(deps): github.com/docker/cli v29.5.3, github.com/docker/buildx v0.34.1, buildkit v0.30.0 by @​thaJeztah in #​13841
• Build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @​dependabot[bot] in #​13832
• Chore(deps): golang.org/x/crypto v0.53.0 by @​thaJeztah in #​13844
• Build(deps): bump github.com/containerd/containerd/v2 from 2.2.3 to 2.2.4 in the go_modules group across 1 directory by @​dependabot[bot] in #​13804
• Chore(deps): bump github.com/containerd/containerd/v2 to v2.2.5 by @​thaJeztah in #​13855
• Chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by @​thaJeztah in #​13847
• Chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 by @​thaJeztah in #​13842
• Bump compose-go to version v2.12.1 by @​glours in #​13865

New Contributors

• @​securityeng-bot[bot] made their first contribution in #​13820
• @​caltechustc made their first contribution in #​13810
• @​solunolab made their first contribution in #​13823
• @​scarab-systems made their first contribution in #​13831
• @​ptrdom made their first contribution in #​13825
• @​rajyan made their first contribution in #​13742
• @​Ijtihed

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.