fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/docker/cli	v29.7.1+incompatible → v29.7.2+incompatible
github.com/docker/compose/v5	v5.3.1 → v5.4.0

---

Release Notes

docker/cli (github.com/docker/cli)

v29.7.2+incompatible

Compare Source

docker/compose (github.com/docker/compose/v5)

v5.4.0

Compare Source

What's Changed

ℹ️ This release introduces a new way to reconcile resources such as volumes and networks

✨ Improvements

• Feat(reconcile): model volume recreation in the plan by @​ndeloof in #​13962
• Feat(reconcile): model network lifecycle in the plan by @​ndeloof in #​13966

🐛 Fixes

• Fix(reconcile): preserve zero-replica services during hashing by @​junhaoliao in #​13931
• Fix(config): warn when service selection is silently ignored by @​glours in #​13950
• Fix(build): use platform image-manifest digest, not attested index by @​glours in #​13949
• Fix(oci): honor --insecure-registry when up re-loads the model by @​ptrdom in #​13894
• Fix(config): pin type:image volume sources and pre_start hook images by @​glours in #​13956
• Tolerate missing env file on more runtime commands by @​maxproske in #​13603
• Resolve pre_start hook images alongside service images by @​ndeloof in #​13937
• Fix(cp): return non-nil Content from dry-run CopyFromContainer by @​glours in #​13982
• Fix(config): apply config flags to --services/--volumes/--networks/--models/--hash by @​glours in #​13979
• Fix: tolerate missing env file on scale, watch and shell completion by @​glours in #​13973

🔧 Internal

• README: remove Go Report Card badge by @​thaJeztah in #​13926
• Docs: adopt AGENTS.md standard, symlink CLAUDE.md to it by @​glours in #​13871
• Dockerfile: update golang image to alpine 3.23 by @​thaJeztah in #​13921
• Docs: require dated AI_AGENT_DISCLOSURE.md, drop committed copy by @​glours in #​13976
• CI: publish images to Docker Hub using OIDC by @​glours in #​13994

⚙️ Dependencies

• Build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by @​dependabot[bot] in #​13942
• Build(deps): bump the docker-actions group across 1 directory with 4 updates by @​dependabot[bot] in #​13941
• Build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​13943
• Build(deps): bump github.com/mattn/go-shellwords from 1.0.13 to 1.0.14 by @​dependabot[bot] in #​13948
• Build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​13927
• Build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​13928
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.13.0 to 1.14.0 in the docker-actions group by @​dependabot[bot] in #​13953
• Build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in #​13922
• Build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @​dependabot[bot] in #​13955
• Build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​13960
• Build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 in the go_modules group across 1 directory by @​dependabot[bot] in #​13961
• Build(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible by @​dependabot[bot] in #​13968
• Build(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 by @​dependabot[bot] in #​13981
• Build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​13970
• Build(deps): bump github.com/moby/buildkit from 0.31.1 to 0.31.2 by @​dependabot[bot] in #​13969
• Bump compose-go to version v2.14.0 by @​glours in #​13983
• Bump go-archive to version v0.3.0 by @​glours in #​13986
• Build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.14.0 to 1.15.0 in the docker-actions group by @​dependabot[bot] in #​13989
• Chore(deps): bump github.com/moby/go-archive v0.3.2 by @​thaJeztah in #​13991
• Update to go1.26.5 by @​thaJeztah in #​13920
• Build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​13996
• Build(deps): bump docker/docker-agent-action/.github/workflows/review-pr.yml from 2.0.2 to 2.0.3 in the docker-actions group by @​dependabot[bot] in #​13995
• Build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 by @​dependabot[bot] in #​13984
• Chore(deps): github.com/docker/buildx v0.36.0, buildkit v0.32.0 by @​glours in #​13975
• Bump buildkit v0.32.1 by @​glours in #​13997

New Contributors

• @​junhaoliao made their first contribution in #​13931

Full Changelog: docker/compose@v5.3.1...v5.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 14 additional dependencies were updated

Details:

Package	Change
github.com/Microsoft/go-winio	v0.6.2 -> v0.6.3-0.20251027160822-ad3df93bed29
github.com/containerd/containerd/api	v1.10.0 -> v1.11.1
github.com/containerd/containerd/v2	v2.2.5 -> v2.3.3
github.com/containerd/ttrpc	v1.2.8 -> v1.2.9
github.com/docker/buildx	v0.35.0 -> v0.36.0
github.com/klauspost/compress	v1.18.6 -> v1.19.1
github.com/mattn/go-shellwords	v1.0.13 -> v1.0.14
github.com/moby/buildkit	v0.31.1 -> v0.32.1
github.com/moby/go-archive	v0.2.0 -> v0.3.2
github.com/sigstore/sigstore-go	v1.2.1 -> v1.2.2
github.com/tonistiigi/fsutil	v0.0.0-20260609091201-0257b3308df4 -> v0.0.0-20260717003753-6d9dc2ebad62
google.golang.org/grpc	v1.81.1 -> v1.82.1
google.golang.org/protobuf	v1.36.11 -> v1.36.12-0.20260120151049-f2248ac996af
gopkg.in/ini.v1	v1.67.0 -> v1.67.3