26.10.0

What's new since 26.6.1

Highlights

• [#156] Fixed ports with a leading zero being read as octal in 'host:port' targets. @AlexSkrypnyk (#159)
  Bash arithmetic reads a number with a leading zero as octal, so a target such as db:08080 printed value too great for base on stderr and only passed validation by accident. The port is now range-checked as base 10, so db:08080 is checked as 8080 with nothing on stderr. No target is classified differently, and nc -z still gets the port exactly as written.

• Aligned the README with the code and added 'CONTRIBUTING.md' and 'SECURITY.md'. @AlexSkrypnyk (#158)
  The README now explains how a target is parsed, including why a bare URL like http://api:8080/health never succeeds without curl -f, and documents the status lines and the exit codes 0, 1 and 2. It also drops a test -S /var/run/app.sock line from the combined example, which checked the wait container's own filesystem, so any stack that copied it timed out. Contributor notes moved to the new CONTRIBUTING.md, and SECURITY.md says where to report vulnerabilities.

• [#146] Enforced 'TIMEOUT_LENGTH' on a probe that hangs. @AlexSkrypnyk (#151)
  A check that hung, like curl -f against a host that drops packets or nc -z to a black-holed address, kept the stack waiting past TIMEOUT_LENGTH for as long as it stayed hung, because the deadline was only checked between attempts. Now a check still running at the deadline is killed along with every process it started and reported as a timeout. A check that legitimately runs longer than TIMEOUT_LENGTH now fails where it used to pass eventually, so raise TIMEOUT_LENGTH to give it room.

• Fixed the 'still waiting' notice timing and labelled the image with its source repository. @AlexSkrypnyk (#147)
  The … still waiting notice only fired when the elapsed time landed on a multiple of 10 seconds, so SLEEP_LENGTH=3 printed it every 30 seconds; it now prints once 10 seconds have passed since the last one, and the default output is unchanged. The image now carries the org.opencontainers.image.source label pointing at this repository, in place of the legacy maintainer label. The PR also fixes 12 unit test rows that couldn't fail, a fixture cleanup that silently did nothing and release drafting that ran twice, and settles naming and conventions across the repo.

• Updated README examples to use the '26.10.0' image tag. @AlexSkrypnyk (#145)
  Both Compose snippets in the README still pinned 25.9.0, 4 releases behind, so anyone who copied one pulled an image from September 2025. They now pin 26.10.0, the image this release publishes.

Other changes

• Update release-drafter/release-drafter digest to 72967cd @renovate[bot] (#160)

• [#150] Removed the 'drevops/ci-runner' container from the 'test' job. @AlexSkrypnyk (#154)
  CI now runs on the bare ubuntu-latest runner, gets ShellCheck, shfmt and hadolint from their own actions and builds kcov from source, so it no longer pulls the drevops/ci-runner image and Renovate stops raising a PR for every new runner tag, like #131 and #134 in this release. The published image is unaffected; CI runs take about 45 seconds longer, mostly while kcov compiles.

• Update release-drafter/release-drafter digest to c345907 @renovate[bot] (#155)

• Removed the 'ignorePaths' override so Renovate skips the fixtures under 'tests/'. @AlexSkrypnyk (#153)
  An ignorePaths override added earlier in this release (#147) replaced the preset's list, so Renovate started opening PRs against the Compose fixtures under tests/, which is where #148, #149 and #152 came from. With the override gone, Renovate skips the fixtures again, and the Dockerfile, workflows and package.json keep getting updates.

• Update php Docker tag to v8.5 @renovate[bot] (#152)

• Pin php Docker tag to 37c8c64 @renovate[bot] (#148)

• Update alpine Docker tag to v3.24 @renovate[bot] (#149)

• Update alpine:3.24.2 Docker digest to 294b683 @renovate[bot] (#144)

• Update alpine Docker tag to v3.24.2 @renovate[bot] (#143)

• Update codecov/codecov-action digest to 303a32d @renovate[bot] (#142)

• Update docker/setup-buildx-action digest to f87e599 @renovate[bot] (#141)

• Update docker/setup-qemu-action digest to 9901266 @renovate[bot] (#140)

• Update docker/setup-buildx-action digest to 594f3bf @renovate[bot] (#139)

• Update docker/build-push-action digest to c3c9e26 @renovate[bot] (#138)

• Update codecov/codecov-action digest to 0b35c9e @renovate[bot] (#137)

• Update docker/setup-qemu-action digest to 1f40c72 @renovate[bot] (#136)

• Update docker/setup-buildx-action digest to 37fe631 @renovate[bot] (#135)

• Update drevops/ci-runner Docker tag to v26.8.0 @renovate[bot] (#134)

• Update toshimaru/auto-author-assign action to v3.1.0 @renovate[bot] (#133)

• Update dependency bats-helpers to v2 @renovate[bot] (#132)

• Update drevops/ci-runner Docker tag to v26.7.0 @renovate[bot] (#131)

• Update release-drafter/release-drafter digest to 34d8067 @renovate[bot] (#130)

• Update docker/login-action digest to dbcb813 @renovate[bot] (#129)

• Update docker/login-action digest to 371161b @renovate[bot] (#128)

• Update docker/login-action digest to abd2ef4 @renovate[bot] (#127)

• Update docker/login-action digest to 06fb636 @renovate[bot] (#126)

• Update actions/checkout digest to 3d3c42e @renovate[bot] (#125)

• Update release-drafter/release-drafter digest to eada3c9 @renovate[bot] (#124)

• Update docker/login-action digest to af1e73f @renovate[bot] (#123)

• Update docker/setup-buildx-action digest to bb05f3f @renovate[bot] (#122)

• Update docker/metadata-action digest to dc80280 @renovate[bot] (#121)

• Update docker/login-action digest to c99871d @renovate[bot] (#120)

• Update docker/setup-qemu-action digest to 96fe6ef @renovate[bot] (#119)

• Update docker/build-push-action digest to 53b7df9 @renovate[bot] (#118)

• Update release-drafter/release-drafter digest to 4d75298 @renovate[bot] (#117)

• Update release-drafter/release-drafter digest to 73b95fa @renovate[bot] (#116)

Full Changelog: 26.6.1...26.10.0