[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/compose-spec/compose-go/v2	v2.16.1 → v2.16.2
github.com/docker/cli	v29.9.1+incompatible → v29.9.2+incompatible
github.com/docker/compose/v5	v5.6.0 → v5.6.1

---

Release Notes

compose-spec/compose-go (github.com/compose-spec/compose-go/v2)

v2.16.2

Compare Source

What's Changed

• types: resolve the environment of pre_start hooks by @​ndeloof in #​938
• types: resolve the labels of pre_start hooks by @​glours in #​939
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in #​941
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in #​940
• types: add use_service_name_alias to service networks by @​glours in #​943
• feat: add the umask service attribute by @​ndeloof in #​942

Full Changelog: compose-spec/compose-go@v2.16.1...v2.16.2

docker/cli (github.com/docker/cli)

v29.9.2+incompatible

Compare Source

docker/compose (github.com/docker/compose/v5)

v5.6.1

Compare Source

update to go1.26.10
These releases include 1 security fix following the security policy:

• crypto/x509: mitigation for security concerns with a specific Certificate Authority

  We're blocking trust in a small set of intermediate certificates due to specific security concerns around their operation.

  Verify will now filter out chains which contain these intermediates, preventing them from being returned to the caller.

  We highly recommend immediately upgrading to this release.

  This is CVE-2026-111943 and Go issue https://go.dev/issue/82345.

Full Changelog: docker/compose@v5.6.0...v5.6.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: pilat/devbox
• Branch: main
• File: .coderabbit.yaml
• Commit: 2b2fa0e
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 662256d0-50ee-4d1a-9848-5a400846a568

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}