chore(deps): migrate to docker compose v5#41
Conversation
|
Warning Review limit reached
More reviews will be available in 47 minutes and 39 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (13)
WalkthroughMigrates Docker Compose from v2 to v5 and Docker Engine client to Moby across the codebase. Adds ChangesDocker Compose v5 + Moby Client Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
fdb5a48 to
edd995b
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/devbox/devbox.go`:
- Around line 83-90: In the newProgressBus() function, fix the display.Full()
call to properly route error and output streams separately. The function
signature expects display.Full(err io.Writer, out io.Writer, detached bool), but
currently both parameters receive the same output stream. Change the first
argument from out to dockerCLI.Err() so that error messages are routed to stderr
while keeping standard output on stdout.
In `@cmd/devbox/shell.go`:
- Line 107: In the return statement that uses fmt.Errorf with the message
"failed to list containers", change the error format verb from `%v` to `%w` to
properly wrap and preserve the error chain. This will maintain consistency with
the similar error handling in the containerExec method (which already uses `%w`
on lines 124 and 129) and ensure that errors.Is and errors.As work correctly for
error chain inspection and type assertion.
In `@cmd/devbox/update.go`:
- Around line 145-170: The issue is that when a sync operation fails and calls
cancelSync(), other goroutines waiting at the start of the loop will send
ctx.Err() to errCh, which can be received and stored as firstErr instead of the
actual git.Sync error. To fix this, remove the context cancellation check and
error sending at line 145 that sends ctx.Err() to the channel, and instead rely
only on the actual sync operation error being sent at line 164 via errCh <- err.
This ensures that only real sync failures are captured and returned, not the
secondary context cancellation errors from fail-fast aborts.
In `@go.mod`:
- Around line 18-136: Update the versions of two vulnerable dependencies in the
go.mod file to address HIGH-severity security vulnerabilities. Change
github.com/containerd/containerd/v2 from v2.2.3 to v2.2.5 or later to fix five
CVEs related to CDI annotation smuggling, image tag poisoning, DoS attacks,
symlink following, and command execution. Change github.com/docker/docker from
v28.5.2 to v29.5.1 or later to fix five CVEs related to arbitrary code
execution, AuthZ bypass, race conditions in docker cp, and privilege validation.
Use go get to update these dependencies or manually edit the version constraints
in the require block.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8b558e7b-1296-4223-b4d3-31fd111c741d
⛔ Files ignored due to path filters (2)
go.sumis excluded by!**/*.sumtests/e2e/e2e_test.gois excluded by!**/*_test.go
📒 Files selected for processing (13)
.goreleaser.ymlcmd/devbox/devbox.gocmd/devbox/down.gocmd/devbox/logs.gocmd/devbox/restart.gocmd/devbox/run.gocmd/devbox/shell.gocmd/devbox/up.gocmd/devbox/update.gogo.modinternal/project/export.gointernal/project/project.goscripts/patch.sh
💤 Files with no reviewable changes (2)
- scripts/patch.sh
- .goreleaser.yml
edd995b to
63d8fa7
Compare
1 participant
Why
docker/compose/v2is a dead module path frozen at 2.40.3 — the rest of the docker stack (cli, moby, compose-go) moved on, so dependency updates kept colliding and wouldn't build. This moves us onto the actively maintained line.What
docker/compose/v2→docker/compose/v5(5.1.4), realigningdocker/cli,compose-goand the newmoby/mobyclient/api modules.Notes
build,vet,lint, unit (-race) and the full e2e suite all pass.Summary by CodeRabbit
New Features
Chores