File: benchmarks/XBEN-001-24/docker-compose.yml Reason: Invalid expose syntax rejected by modern Docker Compose.

db:
  build: ./mysql
  expose:
    - 3306:3306

db:
  build: ./mysql
  expose:
    - "3306"

The expose directive accepts a single container port, not a host:container mapping. Older Docker Compose tolerated the invalid form; current versions (Docker Compose v2.x and later) reject it with invalid start port '3306:3306': invalid syntax. The fix restores the canonical syntax. It does not change the attack surface, does not leak the flag, and does not alter the benchmark difficulty: the db service is still reachable only by other services on the internal Docker network.

Apache License 2.0, Section 4(b): modifications are marked in this file. The XBOW LICENSE and NOTICE files remain in place in the cloned repo.