security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-rg2x-37c3-w2rh	github.com/docker/docker, github.com/google/go-containerregistry	None	v0.20.7	28.5.3-0.20260325120914-0afb41ce194c+incompatible		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

---

Note

Low Risk
Dependency-only lockfile change with no logic edits; risk is limited to behavior differences in the transitive Docker client library used by go-containerregistry.

Overview
Bumps the indirect github.com/docker/docker module from v28.5.2+incompatible to pre-release v28.5.3-0.20260325120914-0afb41ce194c+incompatible in go.mod and go.sum, with no application source changes.

This addresses GHSA-rg2x-37c3-w2rh for the Docker Engine client stack pulled in via github.com/google/go-containerregistry (e.g. registry push/pull in lib/push.go).

^{Reviewed by Cursor Bugbot for commit 5b44ceb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b44ceb. Configure here.}

[cursor]

Ineffective vulnerability remediation

High Severity

This change claims to remediate GHSA-rg2x-37c3-w2rh, but github.com/docker/docker is bumped to a March 25, 2026 pseudo-version. The advisory fix landed in Docker Engine 29.5.1 on May 18, 2026, and the github.com/docker/docker module lists no patched versions. Version comparison can clear the finding without including the actual patch.

 

^{Reviewed by Cursor Bugbot for commit 5b44ceb. Configure here.}