v0.8.3

Security

This release is built with Go 1.27.3, which fixes GO-2026-6809 (CVE-2026-111943) in crypto/x509: certificate chains that pass through a small set of compromised intermediate CA certificates are now rejected. ComposeLock reaches the affected code through its outbound HTTPS connections (heartbeat pings and notifications). v0.8.2 and earlier were built with Go 1.27.2 and do not include the fix, so upgrading is recommended.

This release also updates golang.org/x/net to v0.62.0, which resolves GO-2026-6866 and GO-2026-6860 (HTML parser). ComposeLock does not call the affected code, but the update keeps vulnerability scanners from flagging the release.

Changes

Fixes

• deps: bump go to 1.27.3 for crypto/x509 GO-2026-6809 (1a22921)
• deps: update module github.com/docker/cli to v29.9.2+incompatible (#26) (70a8c0a)
• deps: update docker compose (#27) (f233d04)
• deps: bump golang.org/x/net to v0.62.0 for GO-2026-6866 and GO-2026-6860 (556e147)

What's Changed

• fix(deps): update module github.com/docker/cli to v29.9.2+incompatible by @renovate[bot] in #26
• fix(deps): update docker compose by @renovate[bot] in #27

Full Changelog: v0.8.2...v0.8.3