What's Changed

ℹ️ This release overhauls image digest reconciliation to prevent unnecessary container recreation.
Existing containers may be recreated the first time you run compose up after upgrading, as image digests are re-evaluated using the new logic.

compose pull now honors pull_policy refresh windows (daily, weekly, every_N).

✨ Improvements

• New image digest reconciliation process by @glours & @ndeloof #14011 #14041

🐛 Fixes

• Fix(bridge): skip pulling default image references for build-only ser… by @ericwyles in #14010
• Fix(watch): stop pruning every dangling image of the project by @glours in #14012
• Fix(config): resolve service environment when computing --hash by @glours in #14002
• Fix(watch): skip unreadable directories instead of failing the watch by @Endika in #13992
• Fix: ignore one-off container events in up monitor by @brano-osif in #14038
• Fix(bridge): validate arguments of bridge subcommands by @glours in #14003
• Fix(images): tolerate containers whose image record is gone by @ndeloof in #14028

🔧 Internal

• Test: Set stop_signal to SIGTERM in nginx-based services by @ricardobranco777 in #13881
• Chore: inline needlessly extracted single-use helpers by @ndeloof in #14048
• Add ENGINE column driven by label by @nicksieger in #13959

⚙️ Dependencies

• Build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 by @dependabot[bot] in #13999
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in #14009
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.5 by @dependabot[bot] in #14019
• Build(deps): bump github.com/moby/buildkit from 0.32.1 to 0.32.2 by @dependabot[bot] in #14033
• Build(deps): bump github.com/docker/buildx from 0.36.0 to 0.36.1 by @dependabot[bot] in #14034
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.15.0 to 1.16.0 in the docker-actions group by @dependabot[bot] in #14035
• Build(deps): bump github.com/moby/go-archive from 0.3.2 to 0.3.3 by @dependabot[bot] in #14043
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.37.6 by @dependabot[bot] in #14022
• Build(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.2+incompatible by @dependabot[bot] in #14042
• Build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in #14008
• Bump golang to version 1.26.6 by @glours in #14045

New Contributors

• @ericwyles made their first contribution in #14010
• @Endika made their first contribution in #13992
• @brano-osif made their first contribution in #14038

Full Changelog: v5.4.0...v5.5.0

What's Changed

ℹ️ This release introduces a new way to reconcile resources such as volumes and networks

✨ Improvements

• Feat(reconcile): model volume recreation in the plan by @ndeloof in #13962
• Feat(reconcile): model network lifecycle in the plan by @ndeloof in #13966

🐛 Fixes

• Fix(reconcile): preserve zero-replica services during hashing by @junhaoliao in #13931
• Fix(config): warn when service selection is silently ignored by @glours in #13950
• Fix(build): use platform image-manifest digest, not attested index by @glours in #13949
• Fix(oci): honor --insecure-registry when up re-loads the model by @ptrdom in #13894
• Fix(config): pin type:image volume sources and pre_start hook images by @glours in #13956
• Tolerate missing env file on more runtime commands by @maxproske in #13603
• Resolve pre_start hook images alongside service images by @ndeloof in #13937
• Fix(cp): return non-nil Content from dry-run CopyFromContainer by @glours in #13982
• Fix(config): apply config flags to --services/--volumes/--networks/--models/--hash by @glours in #13979
• Fix: tolerate missing env file on scale, watch and shell completion by @glours in #13973

🔧 Internal

• README: remove Go Report Card badge by @thaJeztah in #13926
• Docs: adopt AGENTS.md standard, symlink CLAUDE.md to it by @glours in #13871
• Dockerfile: update golang image to alpine 3.23 by @thaJeztah in #13921
• Docs: require dated AI_AGENT_DISCLOSURE.md, drop committed copy by @glours in #13976
• CI: publish images to Docker Hub using OIDC by @glours in #13994

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @dependabot[bot] in #13942
• Build(deps): bump the docker-actions group across 1 directory with 4 updates by @dependabot[bot] in #13941
• Build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #13943
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 by @dependabot[bot] in #13948
• Build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @dependabot[bot] in #13927
• Build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @dependabot[bot] in #13928
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0 in the docker-actions group by @dependabot[bot] in #13953
• Build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #13922
• Build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #13955
• Build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #13960
• Build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #13961
• Build(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible by @dependabot[bot] in #13968
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 by @dependabot[bot] in #13981
• Build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #13970
• Build(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 by @dependabot[bot] in #13969
• Bump compose-go to version v2.14.0 by @glours in #13983
• Bump go-archive to version v0.3.0 by @glours in #13986
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.14.0 to 1.15.0 in the docker-actions group by @dependabot[bot] in #13989
• Chore(deps): bump github.com/moby/go-archive v0.3.2 by @thaJeztah in #13991
• Update to go1.26.5 by @thaJeztah in #13920
• Build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @dependabot[bot] in #13996
• Build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.2 to 2.0.3 in the docker-actions group by @dependabot[bot] in #13995
• Build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @dependabot[bot] in #13984
• Chore(deps): github.com/docker/buildx v0.36.0, buildkit v0.32.0 by @glours in #13975
• Bump buildkit v0.32.1 by @glours in #13997

New Contributors

• @junhaoliao made their first contribution in #13931

Full Changelog: v5.3.1...v5.4.0

What's Changed

🔧 Internal

• Ci: add concurrency group to pr-review-trigger to prevent duplicate reviews by @derekmisler in #13890
• Fix grammar in Attestations field comment by @blackflytech in #13891
• Ci: remove unused desktop-edge-test workflow by @thaJeztah in #13897
• Ci: zizmor workflow by @crazy-max in #13901
• Ci: fix docs-upstream workflow by @crazy-max in #13912
• CODEOWNERS: add compose-reviewers by @thaJeztah in #13913
• Ci: harden GitHub Actions workflows by @glours in #13896
• GHA: dependabot: group docker/* actions updates by @thaJeztah in #13914

⚙️ Dependencies

• Build(deps): bump github.com/moby/buildkit from 0.31.0 to 0.31.1 by @dependabot[bot] in #13892
• Build(deps): bump github.com/moby/sys/user to v0.4.1 by @thaJeztah in #13893
• Build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 by @dependabot[bot] in #13876
• Build(deps): bump github.com/docker/cli from 29.6.0+incompatible to 29.6.1+incompatible by @dependabot[bot] in #13895
• Build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #13902
• Build(deps): bump the docker-actions group with 3 updates by @dependabot[bot] in #13916
• Build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #13908
• Build(deps): bump actions/setup-go from 6.3.0 to 6.5.0 by @dependabot[bot] in #13907
• Build(deps): bump test-summary/action from 2.4 to 2.6 by @dependabot[bot] in #13903
• Build(deps): bump mxschmitt/action-tmate from 3.23 to 3.24 by @dependabot[bot] in #13910
• Build(deps): bump codecov/codecov-action from 5.5.3 to 7.0.0 by @dependabot[bot] in #13904
• Build(deps): bump github/codeql-action/upload-sarif from 3.36.3 to 4.36.2 by @dependabot[bot] in #13917
• Build(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in #13911

New Contributors

• @blackflytech made their first contribution in #13891

Full Changelog: v5.3.0...v5.3.1

What's Changed

ℹ️ This release introduces native support for init containers.

✨ Improvements

• Pre start init containers by @glours in #13862

🐛 Fixes

• Fix(oci): route authorizer token fetches through provided transport by @glours in #13873
• Fix(run): scope Running events to project.Services by @glours in #13883

🔧 Internal

• Chore: migrate cagent-action to docker-agent-action (v2.0.0) by @docker-agent in #13869
• Chore: migrate to docker-agent-action v2.0.1 by @docker-agent in #13872
• Fix(reconcile): hash resolved service refs to match executor by @glours in #13880
• Fix(compose/port): show private port in portNotFoundError message by @vmphase in #13875
• Fix(run): normalize --no-TTY flag to --no-tty by @nickjj in #13885

⚙️ Dependencies

• Bump compose-go to version v2.13.0 by @glours in #13886

New Contributors

• @docker-agent made their first contribution in #13869
• @vmphase made their first contribution in #13875
• @nickjj made their first contribution in #13885

Full Changelog: v5.2.0...v5.3.0

What's Changed

ℹ️ This version introduces a new reconciliation algorithm between the observed state and the expected state.

If you experience any issues with a Compose workload that was previously working, please open an issue.

✨ Improvements

• Reconciliation plan by @ndeloof & @glours in #13830
• Add rawsetenv message type for provider plugins by @rajyan in #13742

🐛 Fixes

• Fix(build): skip remote URL contexts from bake fs.read allowlist by @ndeloof in #13816
• Skip validation when extracting config variables by @scarab-systems in #13831
• Fix(progress): probe stderr (not stdout) for TTY auto-detection by @glours in #13837
• Fix(publish): honor env_file required: false for missing files by @Ijtihed in #13848

🔧 Internal

• Docs: compose logs: add links for since/until flag descriptions by @thaJeztah in #13806
• Ci: add Dependabot cooldown (20260603-170456) by @securityeng-bot[bot] in #13820
• Docs(CLAUDE.md): note that commits must be signed off (DCO) by @ndeloof in #13817
• Refactor: replace Split in loops with more efficient SplitSeq and replace HasPrefix+TrimPrefix with CutPrefix by @caltechustc in #13810
• Chore: fix some comments to improve readability by @solunolab in #13823
• GHA: update docs-upstream to pin workflows by sha by @thaJeztah in #13834
• Docs: compose logs: add more links for flag descriptions by @thaJeztah in #13833
• Fix/progress tty line overflow 13595 by @glours in #13840
• Fix(publish): bypass Docker Desktop proxy for loopback registries by @ptrdom in #13825
• Watch: do not rebuild depends_on services on file change by @ndeloof in #13856
• pkg/e2e: fix malformed JWT in fixtures by @thaJeztah in #13857
• pkg/e2e: drop unused run param from getEnv by @glours in #13867
• Docs: ps --format json outputs JSON Lines, not a JSON array by @glours in #13868

⚙️ Dependencies

• Build(deps): bump github.com/docker/cli from 29.5.1+incompatible to 29.5.2+incompatible by @dependabot[bot] in #13802
• Update to go 1.26.4 by @thaJeztah in #13828
• Chore(deps): github.com/containerd/typeurl/v2 v2.3.0 by @thaJeztah in #13829
• Build(deps): bump golang.org/x/sync from 0.20.0 to 0.21.0 by @dependabot[bot] in #13838
• Chore(deps): github.com/docker/cli v29.5.3, github.com/docker/buildx v0.34.1, buildkit v0.30.0 by @thaJeztah in #13841
• Build(deps): bump golang.org/x/sys from 0.45.0 to 0.46.0 by @dependabot[bot] in #13832
• Chore(deps): golang.org/x/crypto v0.53.0 by @thaJeztah in #13844
• Build(deps): bump github.com/containerd/containerd/v2 from 2.2.3 to 2.2.4 in the go_modules group across 1 directory by @dependabot[bot] in #13804
• Chore(deps): bump github.com/containerd/containerd/v2 to v2.2.5 by @thaJeztah in #13855
• Chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by @thaJeztah in #13847
• Chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 by @thaJeztah in #13842
• Bump compose-go to version v2.12.1 by @glours in #13865

New Contributors

• @securityeng-bot[bot] made their first contribution in #13820
• @caltechustc made their first contribution in #13810
• @solunolab made their first contribution in #13823
• @scarab-systems made their first contribution in #13831
• @ptrdom made their first contribution in #13825
• @rajyan made their first contribution in #13742
• @Ijtihed made their first contribution in #13848

Full Changelog: v5.1.4...v5.2.0

What's Changed

✨ Improvements

• feat: add stop lifecycle hook for external providers by @glours in #13779

🐛 Fixes

• fix: route OCI artifact pulls through Docker Desktop HTTP proxy by @glours in #13770
• fix: restore stoppingEvent/stoppedEvent helpers for plugin stop hook by @glours in #13794
• fix(publish): flag literal inline environment values by @glours in #13760

🔧 Internal

• ci: remove unused e2e job from merge workflow by @glours in #13740
• chore: update cagent-action to v1.4.4 by @derekmisler in #13745
• Change verb tense in Docker Compose reference documentation by @ryanjbonnell in #13773
• pkg/compose: go fix by @thaJeztah in #13782
• refactor: code deduplication and simplification by @ndeloof in #13759
• fix: make e2e tests pass reliably locally with Docker Desktop by @glours in #13741
• refactor: drop Desktop beta-settings check; gate hint on LogsTab flag by @glours in #13755

⚙️ Dependencies

• build(deps): bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 by @dependabot[bot] in #13731
• build(deps): bump github.com/docker/cli from 29.4.0+incompatible to 29.4.2+incompatible by @dependabot[bot] in #13768
• build(deps): bump github.com/moby/moby/client from 0.4.0 to 0.4.1 by @dependabot[bot] in #13752
• build(deps): bump github.com/docker/cli from 29.4.2+incompatible to 29.4.3+incompatible by @dependabot[bot] in #13776
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #13775
• build(deps): update to go 1.26.3 by @thaJeztah in #13783
• build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #13791
• build(deps): bump github.com/compose-spec/compose-go/v2 from 2.10.2 to 2.11.0 by @dependabot[bot] in #13798
• build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.1+incompatible by @dependabot[bot] in #13796
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.44.0 by @dependabot[bot] in #13788

New Contributors

• @ryanjbonnell made their first contribution in #13773

Full Changelog: v5.1.3...v5.1.4

What's Changed

🐛 Fixes

• fix: provider output handling and watch rebuild re-invocation by @glours in #13732

🔧 Internal

• Add Docker Desktop Logs view hints and navigation shortcut by @glours in #13721
• Build and push Docker Desktop module image on release by @glours in #13726
• Fix typo in SECURITY.md by @glours in #13730
• Make hook hint deep links clickable using OSC 8 terminal hyperlinks by @glours in #13734
• Remove 'provenance' attribute' by @glours in #13738

⚙️ Dependencies

• build(deps): bump github.com/containerd/containerd/v2 from 2.2.2 to 2.2.3 by @dependabot[bot] in #13737

Full Changelog: v5.1.2...v5.1.3

What's Changed

🐛 Fixes

• Fix TTY timer rendering when duration length changes by @MaybeSam05 in #13634
• Fix up attach filtering by @false200 in #13664
• Preserve ssh:// URL scheme when resolving Dockerfile path by @ssam18 in #13669
• Initialize and pass envFiles map in processExtends by @Mohamed-Moumni in #13678
• Fix TestRunHook_ConsoleSize on macOS by @thaJeztah in #13686
• Restore post-connect fallback for multi-network stacks on API < 1.44 by @jotka in #13629
• Publish: return api.ErrCanceled when user declines interactive prompts by @ishwar170695 in #13674
• Return error on non-ErrNotExist stat failures in Tar.Sync() by @Lidang-Jiang in #13684

🔧 Internal

• Refactor: thread context through publish sensitive data check by @ishwar170695 in #13653
• Add AI-powered PR review workflow via docker/cagent-action by @glours in #13659
• Update cagent-action to latest (with better permissions) by @derekmisler in #13665
• Pin GitHub Actions to commit SHA, remove pr-review workflow by @glours in #13662
• Exclude hook_test.go from Windows builds and propagate ExecStart error in runWaitExec by @pawannn in #13683
• Skip PR review workflow for Dependabot PRs by @glours in #13679
• Use negotiated API version for network setup by @glours in #13690
• Fix mixed assertion libraries in tests by @thaJeztah in #13689
• Test: use random host port for dind TLS build test by @ricardobranco777 in #13630
• Remove direct dependency on docker/docker by @glours in #13706

⚙️ Dependencies

• Bump github.com/containerd/platforms from 1.0.0-rc.2 to 1.0.0-rc.3 by @dependabot[bot] in #13657
• Bump golangci-lint to v2.11.3 and configure CLAUDE to use it on change by @ndeloof in #13656
• Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #13642
• Bump github.com/moby/patternmatcher from 0.6.0 to 0.6.1 by @dependabot[bot] in #13667
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.42.0 by @glours in #13663
• Bump github.com/docker/cli from 29.2.1+incompatible to 29.3.1+incompatible by @dependabot[bot] in #13670
• Bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in #13692
• Bump github.com/docker/buildx v0.33.0, buildkit v0.29.0 by @thaJeztah in #13693
• Bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #13697
• Bump github.com/containerd/platforms from 1.0.0-rc.3 to 1.0.0-rc.4 by @dependabot[bot] in #13696
• Bump github.com/moby/moby/client v0.4.0, moby/api v1.54.1 by @thaJeztah in #13708
• Bump github.com/docker/cli v29.4.0 by @thaJeztah in #13707
• Bump compose-go to version v2.10.2 by @glours in #13705
• Bump to Go 1.25.9 by @thaJeztah in #13720

New Contributors

• @MaybeSam05 made their first contribution in #13634
• @ishwar170695 made their first contribution in #13653
• @derekmisler made their first contribution in #13665
• @false200 made their first contribution in #13664
• @ssam18 made their first contribution in #13669
• @Mohamed-Moumni made their first contribution in #13678
• @pawannn made their first contribution in #13683
• @jotka made their first contribution in #13629
• @Lidang-Jiang made their first contribution in #13684

Full Changelog: v5.1.1...v5.1.2

What's Changed

🐛 Fixes

• Only pass ConsoleSize to ExecAttach when TTY is enabled by @mikesir87 in #13616
• Fix deadlock in ttyWriter.Done() by @maks2134 in #13640

⚙️ Dependencies

• update to go1.25.8 by @thaJeztah in #13622
• bump github.com/moby/moby/api from 1.53.0 to 1.54.0 by @dependabot[bot] in #13619
• bump golang.org/x/sys from 0.41.0 to 0.42.0 by @dependabot[bot] in #13626
• bump github.com/containerd/containerd/v2 from 2.2.1 to 2.2.2 by @dependabot[bot] in #13631
• bump golang.org/x/sync from 0.19.0 to 0.20.0 by @dependabot[bot] in #13627
• bump github.com/moby/moby/client from 0.2.2 to 0.3.0 by @dependabot[bot] in #13621

New Contributors

• @maks2134 made their first contribution in #13640

Full Changelog: v5.1.0...v5.1.1

What's Changed

🐛 Fixes

• emit container status events after network reconnection (fixes #13524) by @MaheshThakur9152 in #13529
• Fix potential nil pointer dereference in container event monitoring by @Nepomuk5665 in #13551
• compose: recreate container when mounted image digest changes by @ibrahimypr in #13549
• fix panic by @ndeloof in #13562
• Fix invalid path error when using OCI artifacts on Windows by @mikesir87 in #13574
• fix: execute post_start hooks in docker compose run by @veeceey in #13607
• Fix panic when watch rebuilds without up by @maxproske in #13610

🔧 Internal

• fsnotify is set in Dockerfile by @ndeloof in #13533
• Dockerfile: update golangci-lint to v2.8.0 by @thaJeztah in #13535
• replace some uses of strings.Split(N) for strings.Cut by @thaJeztah in #13542
• Upgrade GitHub Actions to latest versions by @salmanmkc in #13546
• pkg/compose: remove dependency on github.com/docker/buildx/driver by @thaJeztah in #13563
• use Docker GitHub Builder to build and sign binaries and bin image by @crazy-max in #13568
• ci: fix bin-image job by @crazy-max in #13569
• pkg/compose: defaultNetworkSettings: refactor by @thaJeztah in #13580
• pkg/compose: un-export consts by @thaJeztah in #13584
• modernize some code by @thaJeztah in #13588

⚙️ Dependencies

• update to go1.25.7 by @thaJeztah in #13573
• build(deps): bump golang.org/x/sys from 0.40.0 to 0.41.0 by @dependabot[bot] in #13578
• build(deps): bump go.yaml.in/yaml/v4 from 4.0.0-rc.3 to 4.0.0-rc.4 by @dependabot[bot] in #13541
• migrate to moby modules by @thaJeztah in #13078

New Contributors

• @MaheshThakur9152 made their first contribution in #13529
• @salmanmkc made their first contribution in #13546
• @Nepomuk5665 made their first contribution in #13551
• @ibrahimypr made their first contribution in #13549
• @veeceey made their first contribution in #13607

Full Changelog: v5.0.2...v5.1.0