security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-p436-gjf2-799p	github.com/docker/cli, github.com/google/go-containerregistry	None	v0.20.7	29.2.0+incompatible		confirmed

Not Included

• Deferred by batch limit: 5 advisories. They will be considered by future runs.
• Other deferred scanner findings: 1.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	google.golang.org/grpc	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Dependency-only patch with no source changes; risk is limited to possible behavior differences in the indirect docker/cli library.

Overview
Addresses GHSA-p436-gjf2-799p by forcing the transitive github.com/docker/cli dependency from v29.0.3 to v29.2.0 via a new replace directive in go.mod, with matching go.sum updates.

There are no application code changes; the CLI still pulls docker/cli indirectly (e.g. through go-containerregistry).

^{Reviewed by Cursor Bugbot for commit 5ec0ca8. Bugbot is set up for automated code reviews on this repo. Configure here.}