Version Packages

kits/docker-doctor/CHANGELOG.md

@@ -1,5 +1,12 @@
 # docker-doctor-kit
 
+## 0.1.8
+
+### Patch Changes
+
+- Updated dependencies [f538085]
+  - @docker-doctor/cli@0.5.3
+
 ## 0.1.7
 
 ### Patch Changes

kits/docker-doctor/package.json

@@ -1,9 +1,9 @@
 {
   "name": "docker-doctor-kit",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "private": true,
   "description": "Docker Sandboxes kit for docker-doctor. Changesets manages this version; `bun run kit:sync` mirrors it and the CLI pin into spec.yaml.",
   "dependencies": {
-    "@docker-doctor/cli": "0.5.2"
+    "@docker-doctor/cli": "0.5.3"
   }
 }

kits/docker-doctor/spec.yaml

@@ -4,7 +4,7 @@ name: docker-doctor
 # The kit versions independently of the CLI it installs (see README
 # "Publishing"). CLI releases auto-bump the patch; bump this by hand for
 # kit-only changes.
-version: "0.1.7"
+version: "0.1.8"
 displayName: Docker Doctor
 description: Static analysis for Dockerfiles and Compose files — installs the docker-doctor CLI and its agent skill, and tells the agent to lint before committing Docker changes.
 sourceURL: https://github.com/PunGrumpy/docker-doctor
@@ -30,7 +30,7 @@ setup:
           npm config set proxy "$HTTP_PROXY"
           npm config set https-proxy "$HTTP_PROXY"
         fi
-        npm install -g @docker-doctor/cli@0.5.2
+        npm install -g @docker-doctor/cli@0.5.3
         docker-doctor --version
       user: "0"
       description: "Install pinned @docker-doctor/cli from registry.npmjs.org"

packages/docker-doctor/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @docker-doctor/cli
 
+## 0.5.3
+
+### Patch Changes
+
+- f538085: Add two Compose rules for host bind mounts. `no-broad-bind-mount` (warning) reports services that bind-mount the host root, the home directory or a hidden directory under it, a parent of the project, or a system directory such as `/etc` or `/proc`. `prefer-read-only-bind-mount` (info) reports bind mounts outside the project that are not marked `:ro` / `read_only: true`. Both rules exist because a writable host mount is the foothold for VM-escape bugs like CVE-2026-77179 in Docker Desktop and Docker Sandboxes; mounting less and mounting read-only is the defense that does not depend on the hypervisor.
+
 ## 0.5.2
 
 ### Patch Changes

packages/docker-doctor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docker-doctor/cli",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Static analysis for Dockerfile and Docker Compose files",
   "keywords": [
     "best-practices",