deps: bump github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.15.0

[dependabot]

Bumps github.com/compose-spec/compose-go/v2 from 2.14.0 to 2.15.0.

Release notes

Sourced from github.com/compose-spec/compose-go/v2's releases.

v2.15.0

What's Changed

• Bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in compose-spec/compose-go#905
• fix(override): merge ulimits into the base value by @​vsaraikin in compose-spec/compose-go#907
• loader: skip re-merge of identical resources imported through diamond includes by @​davireis in compose-spec/compose-go#906
• add @​glours as codeowner by @​glours in compose-spec/compose-go#916
• Update README.md by @​ndeloof in compose-spec/compose-go#917
• fix(override): prevent panic on non-string list elements by @​glours in compose-spec/compose-go#915
• introduce Project.WithoutUnresolvedOptionalDependencies by @​ndeloof in compose-spec/compose-go#922
• fix(loader): guard versionWarning global against data races by @​glours in compose-spec/compose-go#919
• fix(types): avoid data race in WithServicesTransform by @​glours in compose-spec/compose-go#920
• replace uses of testify and update logrus to reduce indirect dependencies by @​thaJeztah in compose-spec/compose-go#921
• override: sequence merge ignores strictly-identical duplicate entries by @​ndeloof in compose-spec/compose-go#924
• fix(types): reject unrecognized pull_policy values instead of defaulting by @​glours in compose-spec/compose-go#923
• fix: ignore default .env probe on permission denied by @​ndeloof in compose-spec/compose-go#925
• test: cover short/long ulimit syntax combinations in override merge by @​ndeloof in compose-spec/compose-go#912
• tests: codify the testing contract by @​ndeloof in compose-spec/compose-go#914
• fix: merge attributes of repeated variable occurrences in ExtractVariables by @​ndeloof in compose-spec/compose-go#911
• cli: validate COMPOSE_FILE entries point to actual compose files by @​ndeloof in compose-spec/compose-go#909

New Contributors

• @​vsaraikin made their first contribution in compose-spec/compose-go#907
• @​davireis made their first contribution in compose-spec/compose-go#906

Full Changelog: compose-spec/compose-go@v2.14.0...v2.15.0

Commits

• 4ddbf11 cli: validate COMPOSE_FILE entries point to actual compose files
• 500d50c fix: merge attributes of repeated variable occurrences in ExtractVariables
• 57f6c16 tests: run named table cases as subtests
• 261851b loader/tests: completeness test keeps the conformance matrix exhaustive
• 3843a20 loader/tests: link every attribute file to the spec section it locks
• 728b3f2 loader/tests: loadsAs expresses expectations as canonical YAML
• f8211c4 docs: TESTING.md codifies the testing contract
• 95dbfdf test: cover short/long ulimit syntax combinations in override merge
• 5a10b5a fix: ignore default .env probe on permission denied
• f0442ff fix(types): reject unrecognized pull_policy values instead of defaulting
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dap-code-review-by-crunchloop]

Code Review — c21f999 · CLEAN

Routine Dependabot bump of compose-go/v2 2.14.0 → 2.15.0, and it is clean. I read the full upstream tag-compare (22 commits) and verified every API this repository consumes survives intact: the cli option functions and ProjectFromOptions used by compose/load.go, and the types package surface (Project, ServiceConfig, ServiceVolumeConfig, MappingWithEquals, Labels, ShellCommand, DeployConfig, Resources, Secrets) used across compose/ and up.go. The upstream changes are bug fixes (diamond-include re-merge, override merge panics, a data race in WithServicesTransform, version-warning race) plus additive API; the one strictness change (GetPullPolicy now errors on unrecognized values) is in code this repository never calls. The go.sum deltas (testify, logrus, dropped go-spew/go-difflib) match the upstream dependency-cleanup commit in this range, and compose-go's go 1.24 requirement fits this repo's go 1.25.0. No findings.

What I reviewed

Coverage notes: start_review resolved a directives base SHA, but .dap/code-review.yml does not exist at that commit, so I reviewed against the core prompt alone with no repository-specific bug shapes. I verified compatibility by reading the upstream diff via the GitHub API rather than downloading the module or building — a go build/go test run by a human would confirm compilation, which I could not execute under review rules. Conditional dimensions (redelivery, state-integrity, operability, etc.) do not apply: the change touches only go.mod and go.sum.

---

_{CLEAN — this round found nothing. Reply in a finding's own thread to argue it. On the pull request I answer @dap-code-review-by-crunchloop review, pause and resume.}

[dap-code-review-by-crunchloop]

No open findings on c21f999.

_{The DAP Code Review check run remains the verdict of record. This approval is dismissed if a finding reopens or a later head is not clean.}