What's Changed

🔧 Internal

• Ci: add concurrency group to pr-review-trigger to prevent duplicate reviews by @derekmisler in #13890
• Fix grammar in Attestations field comment by @blackflytech in #13891
• Ci: remove unused desktop-edge-test workflow by @thaJeztah in #13897
• Ci: zizmor workflow by @crazy-max in #13901
• Ci: fix docs-upstream workflow by @crazy-max in #13912
• CODEOWNERS: add compose-reviewers by @thaJeztah in #13913
• Ci: harden GitHub Actions workflows by @glours in #13896
• GHA: dependabot: group docker/* actions updates by @thaJeztah in #13914

⚙️ Dependencies

• Build(deps): bump github.com/moby/buildkit from 0.31.0 to 0.31.1 by @dependabot[bot] in #13892
• Build(deps): bump github.com/moby/sys/user to v0.4.1 by @thaJeztah in #13893
• Build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 by @dependabot[bot] in #13876
• Build(deps): bump github.com/docker/cli from 29.6.0+incompatible to 29.6.1+incompatible by @dependabot[bot] in #13895
• Build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #13902
• Build(deps): bump the docker-actions group with 3 updates by @dependabot[bot] in #13916
• Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #13908
• Build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 by @dependabot[bot] in #13907
• Build(deps): bump test-summary/action from 2.4 to 2.6 by @dependabot[bot] in #13903
• Build(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 by @dependabot[bot] in #13910
• Build(deps): bump codecov/codecov-action from 5.5.3 to 7.0.0 by @dependabot[bot] in #13904
• Build(deps): bump github/codeql-action/upload-sarif from 3.36.3 to 4.36.2 by @dependabot[bot] in #13917
• Build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #13911

New Contributors

• @blackflytech made their first contribution in #13891

Full Changelog: v5.3.0...v5.3.1

What's Changed

ℹ️ This release introduces native support for init containers.

✨ Improvements

• Pre start init containers by @glours in #13862

🐛 Fixes

• Fix(oci): route authorizer token fetches through provided transport by @glours in #13873
• Fix(run): scope Running events to project.Services by @glours in #13883

🔧 Internal

• Chore: migrate cagent-action to docker-agent-action (v2.0.0) by @docker-agent in #13869
• Chore: migrate to docker-agent-action v2.0.1 by @docker-agent in #13872
• Fix(reconcile): hash resolved service refs to match executor by @glours in #13880
• Fix(compose/port): show private port in portNotFoundError message by @vmphase in #13875
• Fix(run): normalize --no-TTY flag to --no-tty by @nickjj in #13885

⚙️ Dependencies

• Bump compose-go to version v2.13.0 by @glours in #13886

New Contributors

• @docker-agent made their first contribution in #13869
• @vmphase made their first contribution in #13875
• @nickjj made their first contribution in #13885

Full Changelog: v5.2.0...v5.3.0

What's Changed

ℹ️ This version introduces a new reconciliation algorithm between the observed state and the expected state.

If you experience any issues with a Compose workload that was previously working, please open an issue.

✨ Improvements

• Reconciliation plan by @ndeloof & @glours in #13830
• Add rawsetenv message type for provider plugins by @rajyan in #13742

🐛 Fixes

• Fix(build): skip remote URL contexts from bake fs.read allowlist by @ndeloof in #13816
• Skip validation when extracting config variables by @scarab-systems in #13831
• Fix(progress): probe stderr (not stdout) for TTY auto-detection by @glours in #13837
• Fix(publish): honor env_file required: false for missing files by @Ijtihed in #13848

🔧 Internal

• Docs: compose logs: add links for since/until flag descriptions by @thaJeztah in #13806
• Ci: add Dependabot cooldown (20260603-170456) by @securityeng-bot[bot] in #13820
• Docs(CLAUDE.md): note that commits must be signed off (DCO) by @ndeloof in #13817
• Refactor: replace Split in loops with more efficient SplitSeq and replace HasPrefix+TrimPrefix with CutPrefix by @caltechustc in #13810
• Chore: fix some comments to improve readability by @solunolab in #13823
• GHA: update docs-upstream to pin workflows by sha by @thaJeztah in #13834
• Docs: compose logs: add more links for flag descriptions by @thaJeztah in #13833
• Fix/progress tty line overflow 13595 by @glours in #13840
• Fix(publish): bypass Docker Desktop proxy for loopback registries by @ptrdom in #13825
• Watch: do not rebuild depends_on services on file change by @ndeloof in #13856
• pkg/e2e: fix malformed JWT in fixtures by @thaJeztah in #13857
• pkg/e2e: drop unused run param from getEnv by @glours in #13867
• Docs: ps --format json outputs JSON Lines, not a JSON array by @glours in #13868

⚙️ Dependencies

• Build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible by @dependabot[bot] in #13802
• Update to go 1.26.4 by @thaJeztah in #13828
• Chore(deps): github.com/containerd/typeurl/v2 v2.3.0 by @thaJeztah in #13829
• Build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by @dependabot[bot] in #13838
• Chore(deps): github.com/docker/cli v29.5.3, github.com/docker/buildx v0.34.1, buildkit v0.30.0 by @thaJeztah in #13841
• Build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #13832
• Chore(deps): golang.org/x/crypto v0.53.0 by @thaJeztah in #13844
• Build(deps): bump github.com/containerd/containerd/v2 from 2.2.3 to 2.2.4 in the go_modules group across 1 directory by @dependabot[bot] in #13804
• Chore(deps): bump github.com/containerd/containerd/v2 to v2.2.5 by @thaJeztah in #13855
• Chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by @thaJeztah in #13847
• Chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 by @thaJeztah in #13842
• Bump compose-go to version v2.12.1 by @glours in #13865

New Contributors

• @securityeng-bot[bot] made their first contribution in #13820
• @caltechustc made their first contribution in #13810
• @solunolab made their first contribution in #13823
• @scarab-systems made their first contribution in #13831
• @ptrdom made their first contribution in #13825
• @rajyan made their first contribution in #13742
• @Ijtihed made their first contribution in #13848

Full Changelog: v5.1.4...v5.2.0

What's Changed

✨ Improvements

• feat: add stop lifecycle hook for external providers by @glours in #13779

🐛 Fixes

• fix: route OCI artifact pulls through Docker Desktop HTTP proxy by @glours in #13770
• fix: restore stoppingEvent/stoppedEvent helpers for plugin stop hook by @glours in #13794
• fix(publish): flag literal inline environment values by @glours in #13760

🔧 Internal

• ci: remove unused e2e job from merge workflow by @glours in #13740
• chore: update cagent-action to v1.4.4 by @derekmisler in #13745
• Change verb tense in Docker Compose reference documentation by @ryanjbonnell in #13773
• pkg/compose: go fix by @thaJeztah in #13782
• refactor: code deduplication and simplification by @ndeloof in #13759
• fix: make e2e tests pass reliably locally with Docker Desktop by @glours in #13741
• refactor: drop Desktop beta-settings check; gate hint on LogsTab flag by @glours in #13755

⚙️ Dependencies

• build(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 by @dependabot[bot] in #13731
• build(deps): bump github.com/docker/cli from 29.4.0+incompatible to 29.4.2+incompatible by @dependabot[bot] in #13768
• build(deps): bump github.com/moby/moby/client from 0.4.0 to 0.4.1 by @dependabot[bot] in #13752
• build(deps): bump github.com/docker/cli from 29.4.2+incompatible to 29.4.3+incompatible by @dependabot[bot] in #13776
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #13775
• build(deps): update to go 1.26.3 by @thaJeztah in #13783
• build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #13791
• build(deps): bump github.com/compose-spec/compose-go/v2 from 2.10.2 to 2.11.0 by @dependabot[bot] in #13798
• build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.1+incompatible by @dependabot[bot] in #13796
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.44.0 by @dependabot[bot] in #13788

New Contributors

• @ryanjbonnell made their first contribution in #13773

Full Changelog: v5.1.3...v5.1.4

What's Changed

🐛 Fixes

• fix: provider output handling and watch rebuild re-invocation by @glours in #13732

🔧 Internal

• Add Docker Desktop Logs view hints and navigation shortcut by @glours in #13721
• Build and push Docker Desktop module image on release by @glours in #13726
• Fix typo in SECURITY.md by @glours in #13730
• Make hook hint deep links clickable using OSC 8 terminal hyperlinks by @glours in #13734
• Remove 'provenance' attribute' by @glours in #13738

⚙️ Dependencies

• build(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to 2.2.3 by @dependabot[bot] in #13737

Full Changelog: v5.1.2...v5.1.3

What's Changed

🐛 Fixes

• Fix TTY timer rendering when duration length changes by @MaybeSam05 in #13634
• Fix up attach filtering by @false200 in #13664
• Preserve ssh:// URL scheme when resolving Dockerfile path by @ssam18 in #13669
• Initialize and pass envFiles map in processExtends by @Mohamed-Moumni in #13678
• Fix TestRunHook_ConsoleSize on macOS by @thaJeztah in #13686
• Restore post-connect fallback for multi-network stacks on API < 1.44 by @jotka in #13629
• Publish: return api.ErrCanceled when user declines interactive prompts by @ishwar170695 in #13674
• Return error on non-ErrNotExist stat failures in Tar.Sync() by @Lidang-Jiang in #13684

🔧 Internal

• Refactor: thread context through publish sensitive data check by @ishwar170695 in #13653
• Add AI-powered PR review workflow via docker/cagent-action by @glours in #13659
• Update cagent-action to latest (with better permissions) by @derekmisler in #13665
• Pin GitHub Actions to commit SHA, remove pr-review workflow by @glours in #13662
• Exclude hook_test.go from Windows builds and propagate ExecStart error in runWaitExec by @pawannn in #13683
• Skip PR review workflow for Dependabot PRs by @glours in #13679
• Use negotiated API version for network setup by @glours in #13690
• Fix mixed assertion libraries in tests by @thaJeztah in #13689
• Test: use random host port for dind TLS build test by @ricardobranco777 in #13630
• Remove direct dependency on docker/docker by @glours in #13706

⚙️ Dependencies

• Bump github.com/containerd/platforms from 1.0.0-rc.2 to 1.0.0-rc.3 by @dependabot[bot] in #13657
• Bump golangci-lint to v2.11.3 and configure CLAUDE to use it on change by @ndeloof in #13656
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #13642
• Bump github.com/moby/patternmatcher from 0.6.0 to 0.6.1 by @dependabot[bot] in #13667
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.42.0 by @glours in #13663
• Bump github.com/docker/cli from 29.2.1+incompatible to 29.3.1+incompatible by @dependabot[bot] in #13670
• Bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in #13692
• Bump github.com/docker/buildx v0.33.0, buildkit v0.29.0 by @thaJeztah in #13693
• Bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #13697
• Bump github.com/containerd/platforms from 1.0.0-rc.3 to 1.0.0-rc.4 by @dependabot[bot] in #13696
• Bump github.com/moby/moby/client v0.4.0, moby/api v1.54.1 by @thaJeztah in #13708
• Bump github.com/docker/cli v29.4.0 by @thaJeztah in #13707
• Bump compose-go to version v2.10.2 by @glours in #13705
• Bump to Go 1.25.9 by @thaJeztah in #13720

New Contributors

• @MaybeSam05 made their first contribution in #13634
• @ishwar170695 made their first contribution in #13653
• @derekmisler made their first contribution in #13665
• @false200 made their first contribution in #13664
• @ssam18 made their first contribution in #13669
• @Mohamed-Moumni made their first contribution in #13678
• @pawannn made their first contribution in #13683
• @jotka made their first contribution in #13629
• @Lidang-Jiang made their first contribution in #13684

Full Changelog: v5.1.1...v5.1.2

What's Changed

🐛 Fixes

• Only pass ConsoleSize to ExecAttach when TTY is enabled by @mikesir87 in #13616
• Fix deadlock in ttyWriter.Done() by @maks2134 in #13640

⚙️ Dependencies

• update to go1.25.8 by @thaJeztah in #13622
• bump github.com/moby/moby/api from 1.53.0 to 1.54.0 by @dependabot[bot] in #13619
• bump golang.org/x/sys from 0.41.0 to 0.42.0 by @dependabot[bot] in #13626
• bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.2 by @dependabot[bot] in #13631
• bump golang.org/x/sync from 0.19.0 to 0.20.0 by @dependabot[bot] in #13627
• bump github.com/moby/moby/client from 0.2.2 to 0.3.0 by @dependabot[bot] in #13621

New Contributors

• @maks2134 made their first contribution in #13640

Full Changelog: v5.1.0...v5.1.1

What's Changed

🐛 Fixes

• emit container status events after network reconnection (fixes #13524) by @MaheshThakur9152 in #13529
• Fix potential nil pointer dereference in container event monitoring by @Nepomuk5665 in #13551
• compose: recreate container when mounted image digest changes by @ibrahimypr in #13549
• fix panic by @ndeloof in #13562
• Fix invalid path error when using OCI artifacts on Windows by @mikesir87 in #13574
• fix: execute post_start hooks in docker compose run by @veeceey in #13607
• Fix panic when watch rebuilds without up by @maxproske in #13610

🔧 Internal

• fsnotify is set in Dockerfile by @ndeloof in #13533
• Dockerfile: update golangci-lint to v2.8.0 by @thaJeztah in #13535
• replace some uses of strings.Split(N) for strings.Cut by @thaJeztah in #13542
• Upgrade GitHub Actions to latest versions by @salmanmkc in #13546
• pkg/compose: remove dependency on github.com/docker/buildx/driver by @thaJeztah in #13563
• use Docker GitHub Builder to build and sign binaries and bin image by @crazy-max in #13568
• ci: fix bin-image job by @crazy-max in #13569
• pkg/compose: defaultNetworkSettings: refactor by @thaJeztah in #13580
• pkg/compose: un-export consts by @thaJeztah in #13584
• modernize some code by @thaJeztah in #13588

⚙️ Dependencies

• update to go1.25.7 by @thaJeztah in #13573
• build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @dependabot[bot] in #13578
• build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.3 to 4.0.0-rc.4 by @dependabot[bot] in #13541
• migrate to moby modules by @thaJeztah in #13078

New Contributors

• @MaheshThakur9152 made their first contribution in #13529
• @salmanmkc made their first contribution in #13546
• @Nepomuk5665 made their first contribution in #13551
• @ibrahimypr made their first contribution in #13549
• @veeceey made their first contribution in #13607

Full Changelog: v5.0.2...v5.1.0

What's Changed

🐛 Fixes

• Fixed progress UI to adapt to terminal width by @ndeloof in #13519
• Removed warning when no explicit build has been requested. by @ndeloof in #13493
• Restored runtime_flags support in models by @ilopezluna in #13460
• Added service name completion to down command by @bmo-at in #13470
• Fixed tilde in --env-file paths expanded to user home directory by @tensorworkerr in #13510
• Handle healthcheck.disable: true by @stavros-k in #13494
• Fixed shutdown and error handling for large file change batches in watch by @amyssnippet in #13525

🔧 Internal

• Added unit test for upOptions.OnExit method by @htoyoda18 in #13489
• clean up temporary compose files after conversion by @htoyoda18 in #13483
• Fixed typo in isSwarmEnabled method name by @htoyoda18 in #13481
• Fixed incorrect usage of errgroup.WithContext by @htoyoda18 in #13480
• Fixed timeout initialization when waitTimeout is zero by @htoyoda18 in #13471
• Extracted API version constants to dedicated file by @htoyoda18 in #13503
• Replace tabbed indentation in sdk.md by @pkqk in #13505
• Improved attach error handling and cleanup by @htoyoda18 in #13488
• Modernize tests by @dgageot in #13531
• set fsnotify build tag when building for OSX by @ndeloof in #13532

⚙️ Dependencies

• build(deps): bump github.com/klauspost/compress to v1.18.2 by @thaJeztah in #13499
• go.mod: remove exclude rules by @thaJeztah in #13498
• build(deps): bump github.com/containerd/containerd/v2 to v2.2.1 by @thaJeztah in #13497
• build(deps): bump golang.org/x/sys from 0.39.0 to 0.40.0 by @dependabot[bot] in #13502
• build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 by @dependabot[bot] in #13475
• build(deps): bump github.com/go-viper/mapstructure/v2 from 2.4.0 to 2.5.0 by @dependabot[bot] in #13506
• build(deps): bump github.com/sirupsen/logrus v1.9.4 by @thaJeztah in #13518
• Bump compose to v2.10.1 by @ndeloof in #13528

New Contributors

• @bmo-at made their first contribution in #13470
• @pkqk made their first contribution in #13505
• @tensorworkerr made their first contribution in #13510
• @stavros-k made their first contribution in #13494
• @amyssnippet made their first contribution in #13525
• @dgageot made their first contribution in #13531

Full Changelog: v5.0.1...v5.0.2

What's Changed

🐛 Fixes

• Restored support for COMPOSE_COMPATIBILITY by @ndeloof in #13424
• Fixed grammatical errors and improve clarity in code. by @xiaolinny in #13429
• Fixed broken run --quiet. by @ndeloof in #13430
• Fixed SDK example by @ndeloof in #13416
• Added a check buildx version is set before comparing it. by @yangfeiyu20102011 in #13415
• Fixed grammar: pluralize 'service' and remove apostrophes in lets. by @rashmivagha in #13423
• Fixed progress UI not restoring terminal once operation completes. by @ndeloof in #13439
• Fixed status alignment in progress UI. by @ndeloof in #13438
• Restored image layer download progress details on pull. by @ndeloof in #13445
• Added 'configured' event at the end of model configuration phase. by @glours in #13446
• Introduced a build tag to select watcher implementation. by @ndeloof in #13452
• Removed mention for v2 on README. by @alexisLefebvre in #13451
• Fixed missing error handling in setEnvWithDotEnv. by @htoyoda18 in #13450
• Adopted morikuni/aec library over raw ANSI sequences. by @ndeloof in #13440
• Prevented incorrect progress metrics to break compose display. by @ndeloof in #13457
• Restored support for BUILDKIT_PROGRESS. by @ndeloof in #13455
• Added check model plugin is successfully loaded. by @ndeloof in #13464
• Added a warning when no service has been selected to build. by @ndeloof in #13467

⚙️ Dependencies

• Drop Go min patch version by @austinvazquez in #13418
• bump golang 1.24.11 by @austinvazquez in #13417
• bump osxcross by @ndeloof in #13425
• bump golang.org/x/sys from 0.38.0 to 0.39.0 by @dependabot[bot] in #13433
• bump github.com/docker/cli-docs-tool from 0.10.0 to 0.11.0 by @dependabot[bot] in #13437
• bump golang.org/x/sync from 0.18.0 to 0.19.0 by @dependabot[bot] in #13434
• bump tags.cncf.io/container-device-interface from 1.0.1 to 1.1.0 by @dependabot[bot] in #13441
• bump github.com/moby/buildkit from 0.26.2 to 0.26.3 by @dependabot[bot] in #13462

New Contributors

• @yangfeiyu20102011 made their first contribution in #13415
• @xiaolinny made their first contribution in #13429
• @alexisLefebvre made their first contribution in #13451
• @htoyoda18 made their first contribution in #13450

Full Changelog: v5.0.0...v5.0.1