compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line breaks while fix position conversion counts only newline characters. A pull request can place one of these separators in a quoted value so fix --apply shifts each later edit and deletes the line after the selected target, including an unselected network or other security setting. The resulting Compose file can remain valid, post-edit checks can pass, and the command can report a successful fix even though the dry-run diff was the only place showing the extra deletion. This issue is fixed in version 0.18.0.

Affected: PyPI: compose-lint

### Impact

`compose-lint fix --apply` converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only `\n`. One of those characters inside a quoted value, which most editors and diff views don't show, shifted every later edit down by one line.

A Compose file from a pull request can use this to make a fix delete the line after the one it meant to change. For example, fixing CL-0014 (`logging: driver: none`) instead removes `driver: none` and the following `networks: [internal]`, moving the service off an internal-only network onto the default bridge. The result is still valid Compose, every check `fix` runs after editing passes, and the command reports `applied 1 fix(es)` and exits 0. A later `compose-lint check` passes too, because no rule requires `networks:`. The dry-run diff (without `--apply`) does show the removed lines, but `--apply` prints only the note for the fix that was selected.

A related crash on the same files could empty the SARIF output for every file in the run. GitHub Code Scanning rejects an empty SARIF upload, which fails the step, so that part does not report a false clean result there.

Found during an internal pre-1.0 security review.

**Docker image.** `composelint/compose-lint` tags 0.9.0 through 0.17.0, and the matching minor tags, are affected when used to run `fix --apply`. Fixed from `0.18.0`.

The GitHub Action d…