[dependabot]

Bumps compose-lint from 0.32.0 to 0.34.0.

Release notes

Sourced from compose-lint's releases.

v0.34.0

Added

• A multi-file corpus for the loader (scripts/corpus/multi/, development tooling). The main corpus stores files singly, so an include:, a cross-file extends:, an env_file: or a COMPOSE_FILE list never resolves there. These scripts keep whole repositories (388 in the October 2026 sample, 1,821 Compose projects), record Compose's own verdict beside compose-lint's, and diff two builds project by project: exit class moved, regressions, newly graded, rule sets changed. It is the evidence behind ADR-038 and the four loader fixes that preceded it. Data stays out of tree under ~/.cache/compose-lint-corpus-multi/, as LICENSE-corpus.md requires.

Changed

• An include:, extends: or env_file: reference may reach anywhere inside the repository. A path written with .. was contained to the Compose project directory while a symlink could reach the directory the run started in, so include: ../shared/compose.yml was a coverage gap (exit 2) and a committed link to the same file was followed. Both are now contained to the repository holding the Compose file — the nearest directory above it with a .git entry, found without running git; without one, the directory compose-lint was run from when it contains the project, else the project directory. The .git directory itself is never read, by path or by link. Over a sample of 1,821 Compose projects from public multi-file repositories, 235 of the 1,324 Compose accepts moved from exit 2 to a verdict, and 7 already-graded projects gained CL-0020 findings from an env_file: above the project that is now read; nothing else changed. A reference leaving the repository, an absolute path, and COMPOSE_FILE written with .. stay as they were. Retiring a coverage gap is a MINOR (ADR-038).

v0.33.0

Changed

• CL-0016 flags a c device cgroup rule that opens /dev/kmsg or /dev/loop-control. device_cgroup_rules: was graded for block devices only, so c 1:11 w plus the default MKNOD capability reached /dev/kmsg, a node CL-0016 flags when it is mapped, with no finding. A c rule with r or w that covers 1:11 or 10:237 (/dev/loop-control), including c 1:* and c *:*, is now flagged on the same terms as a b rule: only when the container can obtain the node. Measured: with the rule a created node opened, and without it the device cgroup refused the open (premise check _cl0016_cgroup_char).

• CL-0016 flags /dev/char/<major>:<minor> spellings of the character devices it already flags. /dev/char holds the kernel's <major>:<minor> symlink for each character device, so a long-syntax

... (truncated)

Changelog

Sourced from compose-lint's changelog.

[0.34.0] - 2026-10-05

Added

• A multi-file corpus for the loader (scripts/corpus/multi/, development tooling). The main corpus stores files singly, so an include:, a cross-file extends:, an env_file: or a COMPOSE_FILE list never resolves there. These scripts keep whole repositories (388 in the October 2026 sample, 1,821 Compose projects), record Compose's own verdict beside compose-lint's, and diff two builds project by project: exit class moved, regressions, newly graded, rule sets changed. It is the evidence behind ADR-038 and the four loader fixes that preceded it. Data stays out of tree under ~/.cache/compose-lint-corpus-multi/, as LICENSE-corpus.md requires.

Changed

• An include:, extends: or env_file: reference may reach anywhere inside the repository. A path written with .. was contained to the Compose project directory while a symlink could reach the directory the run started in, so include: ../shared/compose.yml was a coverage gap (exit 2) and a committed link to the same file was followed. Both are now contained to the repository holding the Compose file — the nearest directory above it with a .git entry, found without running git; without one, the directory compose-lint was run from when it contains the project, else the project directory. The .git directory itself is never read, by path or by link. Over a sample of 1,821 Compose projects from public multi-file repositories, 235 of the 1,324 Compose accepts moved from exit 2 to a verdict, and 7 already-graded projects gained CL-0020 findings from an env_file: above the project that is now read; nothing else changed. A reference leaving the repository, an absolute path, and COMPOSE_FILE written with .. stay as they were. Retiring a coverage gap is a MINOR (ADR-038).

[0.33.0] - 2026-10-05

Changed

• CL-0016 flags a c device cgroup rule that opens /dev/kmsg or /dev/loop-control. device_cgroup_rules: was graded for block devices only, so c 1:11 w plus the default MKNOD capability reached /dev/kmsg, a node CL-0016 flags when it is mapped, with no finding. A c rule with r or w that covers 1:11 or 10:237 (/dev/loop-control), including c 1:* and c *:*, is now flagged on the same terms as a b rule: only when the container can obtain the node. Measured: with the rule a created node opened, and without it the device cgroup refused the open (premise check _cl0016_cgroup_char).

• CL-0016 flags /dev/char/<major>:<minor> spellings of the character devices it already flags. /dev/char holds the kernel's <major>:<minor> symlink for each character device, so a long-syntax

... (truncated)

Commits

• c8032de Prepare 0.34.0 release (#1017)
• a118007 Define overshadowing by the fix the author is already told to make (#1016)
• 64630c9 Point CL-0009 and CL-0010 at their demand-gated settings (#1015)
• 252ac6b Generate every CL-0016 device spelling from one table (#1013)
• abbfc54 Update dependency astral-sh/uv to v0.12.22 (#1009)
• e6f21af Track the multi-file corpus tooling under scripts/corpus/multi (#1012)
• 3bdc241 Regenerate the corpus snapshot, stale since 0.22.0 (#1011)
• 2dc8c7c Follow references anywhere inside the repository (ADR-038) (#1008)
• 549f039 Decide that references are contained to the repository (ADR-038) (#1007)
• bf9ebb1 Bump marketplace-smoke pin to v0.33.0 (#1006)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like compose-lint is up-to-date now, so this is no longer needed.