v1.10.0

New Features

• Ability to warn on FROM images that are to be pulled from an untrusted registry. Use the --trusted-registry CLI option to indicate what registries you trust, or the trustedRegistries key in the configuration file.

Bug fixes

• Shellcheck is now run on ONBUILD RUN instructions
• We make a better effort at detecting what type of shell you use before executing shellcheck rules
• Variables defined in ENV and ARG instructions will be available for shellcheck, removing some of the false positives we had in the past

v1.9.0

New features

• Added new rule DL4006 to warn when using pipes in shell scripts without the -o pipefail option

v1.8.0

New features

• Added new rule DL3025 to warn when the JSON notation for arguments was not used in CMD and ENTRYPOINT instructions

v1.7.5

Changes

• DL3002 renamed to "Last user should not be root." It is now allowed to switch to the root user as long as there is another layer changing it back.

v1.7.4

Bug fixes

• No longer warns on multiple uses of CMD and ENTRYPOINT when used in different FROM stages

v.1.7.2

Bug fixes

• Applies rules to instructions inside ONBUILD
• Understands the ~= operator for pip packages
• Overall better parsing of bash scripts in RUN instructions

v1.7.1

Changes

• Improved distributed binary to not crash on systems with unexpected locale settings
• Can be compiled with GHC 8.0.2

v1.7.0

Major Changes:

• A faster parser
• The parser assumes that files are always in UTF-8 encoding
• Upgraded ShellCheck to 0.5, which brings even more suggestions for RUN instructions
• Docker image is now based on scratch instead of Debian

Bug fixes:

• Fixed parse under certain valid cases when using a new line escape character

v1.6.6

Bugfixes

• Making sure all reported errors contain a line number (#201)

v1.6.5

Bugfixes

• Ability to parse dockerfiles containing port ranges with a protocol (EXPOSE 80-81/udp)