[dogancanbakir]

Bumps gozero (now on moby/moby/client) and testcontainers-go to v0.42.0, removing github.com/docker/docker from the dependency tree entirely.

Fixes #7442.

Summary by CodeRabbit

• Chores
  • Updated Go toolchain and multiple third-party dependencies to latest versions for enhanced stability and security.

[coderabbitai]

Walkthrough

This PR updates go.mod dependency versions across the module graph. Key changes include bumping Golang standard library modules, updating Docker connection and Moby runtime infrastructure, incrementing testcontainers for testing, removing unused gogo/protobuf, downgrading cenkalti/backoff from v5 to v4, and pinning newer versions of compression, logging, and OpenTelemetry observability packages.

Changes

Go Module Dependency Updates

Layer / File(s)	Summary
Container Infrastructure and CVE Remediation go.mod	docker/go-connections v0.6.0→v0.7.0 and multiple moby modules (go-archive, api, client, patternmatcher) bumped to newer releases.
Golang Runtime and Language Tools go.mod	golang.org/x/net v0.54.0→v0.55.0, plus updates to x/exp, x/mod, x/sys, and x/tools for core platform compatibility.
Testing Infrastructure go.mod	testcontainers-go and modules/mongodb both updated from v0.38.0/v0.37.0 to v0.42.0.
Compression, Protocol, Logging, and Observability go.mod	cenkalti/backoff downgraded v5→v4 (v5.0.3→v4.3.0); klauspost/compress v1.18.2→v1.18.5; mattn/go-isatty v0.0.20→v0.0.22; sirupsen/logrus v1.9.3→v1.9.4; gogo/protobuf removed; OpenTelemetry otelhttp and otel metric/trace submodules updated.
Project-Specific Dependencies and Cleanup go.mod	projectdiscovery/gozero updated to 2026-05 prerelease tag; morikuni/aec removed as unused indirect.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Hop along the dependency trail,
Old versions fade, the new ones sail,
From docker pipes to golang's way,
Each module bumped, a safer day. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	❓ Inconclusive	The PR contains multiple dependency updates beyond docker/docker removal; while some updates appear ancillary (golang.org/x/net, compress, logrus, opentelemetry), they are standard maintenance alongside the primary security fix.	Clarify whether all dependency bumps are necessary for the docker/docker removal or if some should be deferred to a separate maintenance PR to keep the security fix focused.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the PR—removing the vulnerable docker/docker dependency through dependency updates.
Linked Issues check	✅ Passed	The PR addresses issue #7442 by updating gozero and testcontainers-go to remove the vulnerable indirect docker/docker dependency, directly fulfilling the requirement to migrate away from docker/docker v28.3.3 with known CVEs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-docker-docker-cve-7442

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

go.mod (1)

1-3: ⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

docker/docker is not fully removed—still present transitively (v27.1.1+incompatible)

Even though github.com/docker/docker is not in go.mod or go.sum, it still appears in the module graph/build list as github.com/docker/docker v27.1.1+incompatible, pulled by github.com/ory/dockertest/v3@v3.12.0 and github.com/praetorian-inc/fingerprintx@v1.1.15. Update dependencies so go mod graph | rg github.com/docker/docker returns no matches.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 1 - 3, The project still pulls github.com/docker/docker
v27.1.1+incompatible transitively via github.com/ory/dockertest/v3 and
github.com/praetorian-inc/fingerprintx; update those dependencies to versions
that no longer depend on docker/docker (or replace them with maintained forks).
Specifically, bump ory/dockertest/v3 and praetorian-inc/fingerprintx to newer
releases that removed the docker/docker dependency (or switch to compatible
alternatives), then run go mod tidy and verify with go mod graph | rg
github.com/docker/docker to ensure no matches remain; update go.mod accordingly
and commit the resulting go.sum changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Around line 127-128: The module graph still pulls the vulnerable
github.com/docker/docker despite bumping
github.com/testcontainers/testcontainers-go; inspect go mod graph to find which
consumers (e.g., github.com/ory/dockertest/v3 and
github.com/praetorian-inc/fingerprintx) bring in github.com/docker/docker, then
either upgrade those modules to versions that drop or upgrade the docker
dependency or add a go.mod replace directive to point github.com/docker/docker
to a fixed upstream (or to moby/moby at a safe version) so the CVE is removed;
after changing versions or adding a replace, run dependency resolution (go get
with the chosen versions and go mod tidy) and re-check go mod graph to confirm
github.com/docker/docker is no longer present.

---

Outside diff comments:
In `@go.mod`:
- Around line 1-3: The project still pulls github.com/docker/docker
v27.1.1+incompatible transitively via github.com/ory/dockertest/v3 and
github.com/praetorian-inc/fingerprintx; update those dependencies to versions
that no longer depend on docker/docker (or replace them with maintained forks).
Specifically, bump ory/dockertest/v3 and praetorian-inc/fingerprintx to newer
releases that removed the docker/docker dependency (or switch to compatible
alternatives), then run go mod tidy and verify with go mod graph | rg
github.com/docker/docker to ensure no matches remain; update go.mod accordingly
and commit the resulting go.sum changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ee37b5ab-1b53-4f54-83e8-72cd0747cd88

📥 Commits

Reviewing files that changed from the base of the PR and between 7414bcb and eef7337.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• go.mod

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify testcontainers-go v0.42.0 removes docker/docker dependency

# Check if v0.42.0 exists
curl -s "https://api.github.com/repos/testcontainers/testcontainers-go/releases" | jq -r '.[].tag_name' | head -20

# Verify the dependency tree after update to confirm docker/docker is removed
go mod download github.com/testcontainers/testcontainers-go@v0.42.0 2>/dev/null && \
  go mod graph | grep -i 'docker/docker' || echo "docker/docker not found in dependency graph (expected)"

Repository: projectdiscovery/nuclei

Length of output: 332

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Check whether testcontainers-go v0.42.0 exists =="
go list -m -versions github.com/testcontainers/testcontainers-go

echo
echo "== Confirm resolved version in this repo =="
go list -m -f '{{.Version}}' github.com/testcontainers/testcontainers-go

echo
echo "== Find all docker/docker occurrences in module graph =="
go mod graph | rg -n 'github\.com/docker/docker'

echo
echo "== Explain why github.com/docker/docker is in the graph =="
go mod why -m github.com/docker/docker || true

Repository: projectdiscovery/nuclei

Length of output: 1087

---

testcontainers-go v0.42.0 exists, but it doesn’t eliminate docker/docker from the module graph

• github.com/testcontainers/testcontainers-go v0.42.0 is a valid release and the repo resolves it to v0.42.0.
• github.com/docker/docker is still present in go mod graph (e.g., via github.com/ory/dockertest/v3@v3.12.0 and github.com/praetorian-inc/fingerprintx@v1.1.15), with no indication it was removed by the testcontainers-go bump.
• Update the dependency chain (or clarify the mitigation) so the CVE’s vulnerable docker/docker version is actually removed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 127 - 128, The module graph still pulls the vulnerable
github.com/docker/docker despite bumping
github.com/testcontainers/testcontainers-go; inspect go mod graph to find which
consumers (e.g., github.com/ory/dockertest/v3 and
github.com/praetorian-inc/fingerprintx) bring in github.com/docker/docker, then
either upgrade those modules to versions that drop or upgrade the docker
dependency or add a go.mod replace directive to point github.com/docker/docker
to a fixed upstream (or to moby/moby at a safe version) so the CVE is removed;
after changing versions or adding a replace, run dependency resolution (go get
with the chosen versions and go mod tidy) and re-check go mod graph to confirm
github.com/docker/docker is no longer present.