Docker 28, and a release note I actually read

A major version of the engine, read properly rather than upgraded and hoped for.

what mattered, from a release note of about 60 items:

  the default bridge network's firewall behaviour
    changes — published ports are no longer reachable
    from other hosts by default on some configurations.
    → we publish to 127.0.0.1 and proxy, so no change,
      and this would have been an outage if we did not.

  compose bake as a build backend, opt-in.
  a handful of CLI flag deprecations, none in use.

time spent: 40 minutes. incidents avoided: probably one.

The networking change is the kind that breaks a setup which was accidentally working, and the only defence is reading. Forty minutes against a release note is a poor use of time in nine upgrades out of ten and pays for all of them in the tenth — which is an argument that only works if somebody keeps doing it during the nine.