security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-rg2x-37c3-w2rh	github.com/docker/docker, github.com/google/go-containerregistry	None	v0.20.7	28.5.3-0.20260325120914-0afb41ce194c+incompatible		confirmed

Not Included

• Deferred by batch limit: 5 advisories. They will be considered by future runs.
• Other deferred scanner findings: 82.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/aymanbagabas/go-osc52/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cpuguy83/go-md2man/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/go-viper/mapstructure/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/grpc-ecosystem/grpc-gateway/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/knadh/koanf/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/russross/blackfriday/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/c2h5oh/datasize	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/bubbles	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/charmbracelet/bubbletea	Non-CVE alert is not handled by dependency remediation.
...	...	72 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Indirect dependency bump only, with no application logic changes; main residual risk is compatibility of the pinned pre-release Docker module with existing containerregistry usage.

Overview
Addresses GHSA-rg2x-37c3-w2rh by forcing a newer github.com/docker/docker than the indirect v28.5.2 pulled in through github.com/google/go-containerregistry (used for image push/registry flows).

The only manifest change is a new replace directive pointing docker/docker at v28.5.3-0.20260325120914-0afb41ce194c+incompatible; go.sum is refreshed for the updated transitive graph. No Go source files are modified.

^{Reviewed by Cursor Bugbot for commit b5d74af. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ulziibay-kernel]

Replaced the original pseudo-version pin, which moved out of the scanner's vulnerable range without containing the docker cp fix, with an upgrade to go-containerregistry 0.21.7. That drops github.com/docker/docker from the graph in favour of moby/moby/client; go list -deps confirms none of the affected code is linked. CI green.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3fd83c1. Configure here.}

[cursor]

Ineffective CVE remediation pin

High Severity

The new replace for github.com/docker/docker pins commit 0afb41ce194c (March 2026 plugin privilege fix), not the GHSA-rg2x-37c3-w2rh fix (bb6a9b1, May 2026). github.com/google/go-containerregistry stays at v0.20.7, and the Go vuln DB lists no fixed docker/docker release for this advisory, so the claimed remediation does not land.

Additional Locations (1)

• go.mod#L10-L11

 

^{Reviewed by Cursor Bugbot for commit 3fd83c1. Configure here.}