GHSA-RM8W-W798-G545 compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`

Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the $NAME a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings...

CVE-2026-123372 compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. ...