The project currently depends on the deprecated/unmaintained github.com/docker/docker module at v28.5.2+incompatible, which is flagged by govulncheck as vulnerability GO-2026-4883. There is no fixed version in this module line, so to resolve the security scan failure and preserve maintainability, all Docker code must migrate to supported SDK modules (typically under github.com/moby/moby).
Acceptance Criteria
- Replace all usages of
github.com/docker/docker and its submodules (notably in internal/container/controller.go and any related files) with officially-supported modules (e.g., github.com/moby/moby/client).
- Update code for any API or type changes in the Docker/Moby Go SDKs.
- Remove
github.com/docker/docker from go.mod, add any needed new modules, and run go mod tidy.
- Test and verify all container functionality works as before.
- Re-run the Security Scanning (govulncheck) workflow and confirm that the Docker vulnerability is not detected.
References
The project currently depends on the deprecated/unmaintained
github.com/docker/dockermodule at v28.5.2+incompatible, which is flagged bygovulncheckas vulnerability GO-2026-4883. There is no fixed version in this module line, so to resolve the security scan failure and preserve maintainability, all Docker code must migrate to supported SDK modules (typically undergithub.com/moby/moby).Acceptance Criteria
github.com/docker/dockerand its submodules (notably ininternal/container/controller.goand any related files) with officially-supported modules (e.g.,github.com/moby/moby/client).github.com/docker/dockerfrom go.mod, add any needed new modules, and rungo mod tidy.References