[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-rg2x-37c3-w2rh	github.com/docker/docker, github.com/google/go-containerregistry	None	v0.20.7	28.5.3-0.20260325120914-0afb41ce194c+incompatible		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 0.
• Unconfirmed attempted fixes: 0.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b44ceb. Configure here.}

[ulziibay-kernel]

Approving: single-advisory dependency bump, lockfile/manifest only, no source changes.

[ulziibay-kernel]

Closing: this bump does not remediate CVE-2026-42306.

The advisory lists no patched version for the github.com/docker/docker module path. The fix landed only in github.com/moby/moby/v2 >= v2.0.0-beta.14 (tagged 2026-05-18, immediately before disclosure). The version pinned here, 28.5.3-0.20260325120914-0afb41ce194c, resolves to a 2026-03-25 commit that is 3785 commits behind that tag and on a diverged branch, so it cannot contain the fix.

Merging would move a production dependency onto an untagged mid-development Docker commit and mark the CVE resolved in scanners while it remains exploitable. Remediation requires migrating the import path to github.com/moby/moby/v2, which is a code change rather than a version bump.