v0.8.3

Security

This release is built with Go 1.27.3, which fixes GO-2026-6809 (CVE-2026-111943) in crypto/x509: certificate chains that pass through a small set of compromised intermediate CA certificates are now rejected. ComposeLock reaches the affected code through its outbound HTTPS connections (heartbeat pings and notifications). v0.8.2 and earlier were built with Go 1.27.2 and do not include the fix, so upgrading is recommended.

This release also updates golang.org/x/net to v0.62.0, which resolves GO-2026-6866 and GO-2026-6860 (HTML parser). ComposeLock does not call the affected code, but the update keeps vulnerability scanners from flagging the release.

Changes

Fixes

• deps: bump go to 1.27.3 for crypto/x509 GO-2026-6809 (1a22921)
• deps: update module github.com/docker/cli to v29.9.2+incompatible (#26) (70a8c0a)
• deps: update docker compose (#27) (f233d04)
• deps: bump golang.org/x/net to v0.62.0 for GO-2026-6866 and GO-2026-6860 (556e147)

What's Changed

• fix(deps): update module github.com/docker/cli to v29.9.2+incompatible by @renovate[bot] in #26
• fix(deps): update docker compose by @renovate[bot] in #27

Full Changelog: v0.8.2...v0.8.3

v0.8.2

Changes

Fixes

• deps: bump Go to 1.27.2 and golang.org/x/net to v0.60.0 (#25) (8cdc0e0)
• deps: update module golang.org/x/sync to v0.24.0 (#20) (6fcfa65)
• deps: update module github.com/moby/moby/client to v0.6.2 (#21) (e75b98f)
• deps: update module github.com/docker/cli to v29.9.1+incompatible (#22) (0e0481c)

Maintenance

• deps: update module golang.org/x/vuln to v1.9.0 (#23) (d20caf4)
• deps: update module honnef.co/go/tools to v0.8.2 (#24) (271b476)

What's Changed

• fix(deps): bump Go to 1.27.2 and golang.org/x/net to v0.60.0 by @teyhouse in #25
• fix(deps): update module golang.org/x/sync to v0.24.0 by @renovate[bot] in #20
• fix(deps): update module github.com/moby/moby/client to v0.6.2 by @renovate[bot] in #21
• fix(deps): update module github.com/docker/cli to v29.9.1+incompatible by @renovate[bot] in #22
• chore(deps): update module golang.org/x/vuln to v1.9.0 by @renovate[bot] in #23
• chore(deps): update module honnef.co/go/tools to v0.8.2 by @renovate[bot] in #24

Full Changelog: v0.8.1...v0.8.2

v0.8.1

Changes

Fixes

• deps: update module github.com/docker/cli to v29.8.2+incompatible (#16) (3a8ab6a)
• deps: update module github.com/docker/compose/v5 to v5.6.0 (4ac9ae5)

Maintenance

• renovate: group docker compose and compose-go updates (f1e0494)

What's Changed

• fix(deps): update module github.com/docker/cli to v29.8.2+incompatible by @renovate[bot] in #16
• fix(deps): update module github.com/docker/compose/v5 to v5.6.0 by @renovate[bot] in #18

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Changes

Features

• compose: pull images for all changed stacks before the first up (e6c1e8b)
• add pause/resume and a deployment history to the state (b3cae24)
• notify: add a generic JSON webhook next to Discord (2bd4462)
• add an optional deploy_window for new commits (935d904)
• log: add a configurable log_level (61254b2)

Fixes

• cmd: print pause and resume results once instead of also logging them (83ebbdc)

Maintenance

• apply go fix modernizations (8846d02)

What's Changed

• feat(compose): pull images for all changed stacks before the first up by @teyhouse in #12
• feat: add pause/resume and a deployment history to the state by @teyhouse in #13
• feat(notify): add a generic JSON webhook next to Discord by @teyhouse in #14
• feat: add an optional deploy_window for new commits by @teyhouse in #15

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Changes

Features

• monitor: alert on unhealthy stacks between deploys (62b3d8e)
• notify: add commit subject, author and links to notifications (b4a714f)
• heartbeat: add heartbeat_url dead-man's switch and /healthz (5e4ecb1)

Fixes

• deps: update module github.com/docker/cli to v29.8.1+incompatible (#8) (451279f)

What's Changed

• fix(deps): update module github.com/docker/cli to v29.8.1+incompatible by @renovate[bot] in #8
• feat(monitor): alert on unhealthy stacks between deploys by @teyhouse in #9
• feat(notify): add commit subject, author and links to notifications by @teyhouse in #10
• feat(heartbeat): add heartbeat_url dead-man's switch and /healthz by @teyhouse in #11

Full Changelog: v0.6.6...v0.7.0

v0.6.6

Changes

Fixes

• reconcile: reset pre-flight block counter after reverting a commit (b098ddd)
• poll: time the poll interval from each run's start, not its end (e911ef4)

Documentation

• split README into topic pages under docs/ (26d7d0f)

Full Changelog: v0.6.5...v0.6.6

v0.6.5

Changes

Fixes

• relative repo_path skips and stacks orphaned by a revert (fe1366c)

Full Changelog: v0.6.3...v0.6.5

v0.6.3

Changes

Fixes

• compose: resolve dockerfile against its build context and report dropped inputs (70a403c)
• own up-timeout reverts, discovery retries, vanished containers (e2f8971)

Maintenance

• compose: add input and discovery properties with a fuzz target (a5201f3)

Full Changelog: v0.6.2...v0.6.3

v0.6.2

Changes

Fixes

• false promotions, revert stack scope and redaction overreach (e3717e3)
• wedged health watches, recovery without fetch and unbuilt images (04470ab)

Documentation

• lead with the container setup and compress the README (990d603)

Maintenance

• execx: fuzz credential redaction and add a make fuzz target (0fe66c8)
• reconcile: add state-machine invariants with a shrinking harness (548c099)
• health: add watch property tests pinning the streak semantics (62ef6f1)

Full Changelog: v0.6.0...v0.6.2

v0.6.0

Changes

⚠️ Breaking changes

• close 20 correctness bugs across reconcile, health, git and config (e415a0a)
• close 7 gaps around the pre-flight gate and change detection (e0c13e6)
• close 9 logic bugs across the CLI, discovery, health and webhook (64ce57a)

Fixes

• follow include and extends, and stop blaming infra on the commit (48693a3)
• teardown latency, restart churn, alert throttling and status lock (acc932c)
• relative compose_file resolution and the recovery time budget (22b05be)
• dir-mode inputs outside compose_dir, revert retries, redaction (4028550)

Full Changelog: v0.4.0...v0.6.0