From ca1d4b6b51fd90793337434dbe64d2721a2b48fa Mon Sep 17 00:00:00 2001
From: "docker-doctor[bot]"
 <330460674+docker-doctor[bot]@users.noreply.github.com>
Date: Sat, 19 Sep 2026 17:01:59 +0000
Subject: [PATCH] Version Packages

---
 .changeset/narrow-read-only-bind-mounts.md | 5 -----
 bun.lock                                   | 4 ++--
 kits/docker-doctor/CHANGELOG.md            | 7 +++++++
 kits/docker-doctor/package.json            | 4 ++--
 kits/docker-doctor/spec.yaml               | 4 ++--
 packages/docker-doctor/CHANGELOG.md        | 6 ++++++
 packages/docker-doctor/package.json        | 2 +-
 7 files changed, 20 insertions(+), 12 deletions(-)
 delete mode 100644 .changeset/narrow-read-only-bind-mounts.md

diff --git a/.changeset/narrow-read-only-bind-mounts.md b/.changeset/narrow-read-only-bind-mounts.md
deleted file mode 100644
index 7d91240..0000000
--- a/.changeset/narrow-read-only-bind-mounts.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@docker-doctor/cli": patch
----
-
-Add two Compose rules for host bind mounts. `no-broad-bind-mount` (warning) reports services that bind-mount the host root, the home directory or a hidden directory under it, a parent of the project, or a system directory such as `/etc` or `/proc`. `prefer-read-only-bind-mount` (info) reports bind mounts outside the project that are not marked `:ro` / `read_only: true`. Both rules exist because a writable host mount is the foothold for VM-escape bugs like CVE-2026-77179 in Docker Desktop and Docker Sandboxes; mounting less and mounting read-only is the defense that does not depend on the hypervisor.
diff --git a/bun.lock b/bun.lock
index be41b83..88e3beb 100644
--- a/bun.lock
+++ b/bun.lock
@@ -54,7 +54,7 @@
     },
     "kits/docker-doctor": {
       "name": "docker-doctor-kit",
-      "version": "0.1.7",
+      "version": "0.1.8",
       "dependencies": {
         "@docker-doctor/cli": "0.5.1",
       },
@@ -73,7 +73,7 @@
     },
     "packages/docker-doctor": {
       "name": "@docker-doctor/cli",
-      "version": "0.5.2",
+      "version": "0.5.3",
       "bin": {
         "docker-doctor": "dist/cli.mjs",
       },
diff --git a/kits/docker-doctor/CHANGELOG.md b/kits/docker-doctor/CHANGELOG.md
index 6fa98c1..f8e5bff 100644
--- a/kits/docker-doctor/CHANGELOG.md
+++ b/kits/docker-doctor/CHANGELOG.md
@@ -1,5 +1,12 @@
 # docker-doctor-kit
 
+## 0.1.8
+
+### Patch Changes
+
+- Updated dependencies [f538085]
+  - @docker-doctor/cli@0.5.3
+
 ## 0.1.7
 
 ### Patch Changes
diff --git a/kits/docker-doctor/package.json b/kits/docker-doctor/package.json
index ecd12f6..1e2def3 100644
--- a/kits/docker-doctor/package.json
+++ b/kits/docker-doctor/package.json
@@ -1,9 +1,9 @@
 {
   "name": "docker-doctor-kit",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": true,
   "description": "Docker Sandboxes kit for docker-doctor. Changesets manages this version; `bun run kit:sync` mirrors it and the CLI pin into spec.yaml.",
   "dependencies": {
-    "@docker-doctor/cli": "0.5.2"
+    "@docker-doctor/cli": "0.5.3"
   }
 }
diff --git a/kits/docker-doctor/spec.yaml b/kits/docker-doctor/spec.yaml
index 2bd8fd9..88227f6 100644
--- a/kits/docker-doctor/spec.yaml
+++ b/kits/docker-doctor/spec.yaml
@@ -4,7 +4,7 @@ name: docker-doctor
 # The kit versions independently of the CLI it installs (see README
 # "Publishing"). CLI releases auto-bump the patch; bump this by hand for
 # kit-only changes.
-version: "0.1.7"
+version: "0.1.8"
 displayName: Docker Doctor
 description: Static analysis for Dockerfiles and Compose files — installs the docker-doctor CLI and its agent skill, and tells the agent to lint before committing Docker changes.
 sourceURL: https://github.com/PunGrumpy/docker-doctor
@@ -30,7 +30,7 @@ setup:
           npm config set proxy "$HTTP_PROXY"
           npm config set https-proxy "$HTTP_PROXY"
         fi
-        npm install -g @docker-doctor/cli@0.5.2
+        npm install -g @docker-doctor/cli@0.5.3
         docker-doctor --version
       user: "0"
       description: "Install pinned @docker-doctor/cli from registry.npmjs.org"
diff --git a/packages/docker-doctor/CHANGELOG.md b/packages/docker-doctor/CHANGELOG.md
index 2aba894..420129d 100644
--- a/packages/docker-doctor/CHANGELOG.md
+++ b/packages/docker-doctor/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @docker-doctor/cli
 
+## 0.5.3
+
+### Patch Changes
+
+- f538085: Add two Compose rules for host bind mounts. `no-broad-bind-mount` (warning) reports services that bind-mount the host root, the home directory or a hidden directory under it, a parent of the project, or a system directory such as `/etc` or `/proc`. `prefer-read-only-bind-mount` (info) reports bind mounts outside the project that are not marked `:ro` / `read_only: true`. Both rules exist because a writable host mount is the foothold for VM-escape bugs like CVE-2026-77179 in Docker Desktop and Docker Sandboxes; mounting less and mounting read-only is the defense that does not depend on the hypervisor.
+
 ## 0.5.2
 
 ### Patch Changes
diff --git a/packages/docker-doctor/package.json b/packages/docker-doctor/package.json
index ee1ea35..50925d4 100644
--- a/packages/docker-doctor/package.json
+++ b/packages/docker-doctor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@docker-doctor/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Static analysis for Dockerfile and Docker Compose files",
   "keywords": [
     "best-practices",