CVE-2026-125123

### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Affected setups pass repository paths to compose-lint without a `--` before them: the pre-commit hook when `args:` is set without the documented trailing `--`, or the `compose-lint` package or Docker image called that way in a workflow. The pre-commit hook's default configuration passes `--` and is not affected. The GitHub Action turns command processing off around each compose-lint run, so it is not affected. Found during an internal pre-1.0 security review. It was first published as part of GHSA-r7j4-crjv-h467, together with four other gaps in the same fix. Each gap now has its own advisory. **Docker image.** `composelint/compose-lint` tag 0.31.0 and the matching minor tag are affected, as was `latest` while it pointed to 0.31.0. Releases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6. ### Patches Fixed in 0.32.0. The argument parser's messages go through the same sanitizer as the rest of compose-lint's output. ### Workarounds - Upgrade to 0.32.0 or later. - End the pre-commit hook's `args:` with `--`, and put `--` before file paths when calling compose-lint directly. - On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::<random token>` and `::<token>::`, as the Ac