security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-p436-gjf2-799p	github.com/docker/cli, github.com/google/go-containerregistry	None	v0.20.7	29.2.0+incompatible		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	google.golang.org/grpc	Non-CVE alert is not handled by dependency remediation.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b1a15b0. Configure here.}

[cursor]

Incomplete docker/cli vulnerability remediation

Medium Severity

github.com/docker/cli remains required at vulnerable v29.0.3+incompatible, with the GHSA-p436-gjf2-799p bump applied only through a version-specific replace to v29.2.0+incompatible. That override applies only while the selected version stays exactly v29.0.3, so a later transitive bump can silently drop the patch and reintroduce the advisory.

Additional Locations (1)

• go.mod#L43-L44

 

^{Reviewed by Cursor Bugbot for commit b1a15b0. Configure here.}