security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-rg2x-37c3-w2rh	github.com/docker/docker, github.com/google/go-containerregistry	None	v0.20.7	28.5.3-0.20260325120914-0afb41ce194c+incompatible		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 47.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	github.com/Azure/go-ansiterm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cenkalti/backoff/v4	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/containerd/errdefs/pkg	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/containerd/errdefs	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/containerd/stargz-snapshotter/estargz	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/davecgh/go-spew	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/distribution/reference	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/docker/cli	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/docker/distribution	Non-CVE alert is not handled by dependency remediation.
...	...	37 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Dependency-only change with no app code edits; risk is limited to possible behavior differences in the patched docker/docker transitive stack used by go-containerregistry.

Overview
Addresses GHSA-rg2x-37c3-w2rh by pinning github.com/docker/docker to a patched build through a new replace in go.mod (v28.5.2+incompatible → v28.5.3-0.20260325120914-0afb41ce194c+incompatible). The direct github.com/google/go-containerregistry version is unchanged; the fix rides on the updated transitive Docker engine dependency that container registry tooling pulls in.

go.sum is refreshed for the replaced module and its added transitive packages (e.g. CLI/credential-related deps). No application Go source changes in this diff.

^{Reviewed by Cursor Bugbot for commit a1a7f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b44ceb. Configure here.}