security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-rg2x-37c3-w2rh	github.com/docker/docker, github.com/google/go-containerregistry	None	v0.20.7	28.5.3-0.20260325120914-0afb41ce194c+incompatible		confirmed

Not Included

• Deferred by batch limit: 5 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	google.golang.org/grpc	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Scope is limited to module replace and lockfile updates for a known advisory; risk is slightly elevated because the fix uses a pre-release Docker module revision rather than a stable tagged release.

Overview
Addresses GHSA-rg2x-37c3-w2rh by pinning github.com/docker/docker through a new go.mod replace from v28.5.2+incompatible to v28.5.3-0.20260325120914-0afb41ce194c+incompatible, with matching go.sum checksum updates.

This is dependency-only remediation (no application code changes); the Docker engine client remains an indirect dependency pulled in via github.com/google/go-containerregistry (e.g. image push).

^{Reviewed by Cursor Bugbot for commit 59bcdee. Bugbot is set up for automated code reviews on this repo. Configure here.}