shankar0123 f2c77ba3fb deps: bump testcontainers-go v0.35.0 → v0.42.0; drops docker/docker dep entirely (clears CVE-2026-34040) ...

Dependabot flagged GHSA-x744-4wpc-v9h2 / CVE-2026-34040 (Moby AuthZ
plugin bypass on oversized request bodies, incomplete fix for
CVE-2024-41110) on the transitive github.com/docker/docker
v27.1.1+incompatible pulled in via testcontainers-go v0.35.0.

Reachability check before fixing:

  - certctl does not run dockerd or configure AuthZ plugins.
  - go list -deps ./cmd/{server,agent,cli,mcp-server}/... finds zero
    docker/docker references in any production binary's transitive
    set.
  - testcontainers is consumed only by *_test.go files under
    internal/repository/postgres/ + deploy/test/ for ephemeral
    Postgres containers.

So the CVE was not reachable from any shipped certctl artefact.
Bump anyway because Dependabot noise is noise; the upgrade is
mechanical.

Bumping testcontainers-go v0.35.0 → v0.42.0 (latest, 2026-04-09)
removes the direct docker/docker dependency entirely — testcontainers
v0.42.0 reorganized away from the Moby SDK. After 'go mod tidy',
docker/docker is GONE from both go.mod and go.sum, not merely
bumped. The Dependabot alert closes automatically on push.

Co-bumped transitives (cascading from testcontainers' new dep tree):

  go.opentelemetry.io/otel               v1.24.0  → v1.41.0
  go.opentelemetry.io/otel/{metric,trace} v1.24.0  → v1.41.0
  go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
                                         v0.49.0  → v0.60.0
  go.opentelemetry.io/auto/sdk           added    @ v1.2.1
  golang.org/x/crypto                    v0.45.0  → v0.48.0
  golang.org/x/net                       v0.47.0  → v0.49.0
  golang.org/x/sync                      v0.18.0  → v0.19.0
  golang.org/x/sys                       v0.40.0  → v0.42.0
  golang.org/x/text                      v0.31.0  → v0.34.0

Verification (all green):

  go build ./cmd/server/... ./cmd/agent/... ./cmd/cli/... \
           ./cmd/mcp-server/...                          → exit 0
  go test -run=NONE -count=1 ./internal/repository/postgres/  → ok
  go test -tags=integration -run=NONE -count=1 ./deploy/test/ → ok
  go vet ./internal/repository/postgres/...                   → clean
  go list -deps ./cmd/{server,agent,cli,mcp-server}/... |
    grep docker                                               → zero hits

Diff: 2 files (go.mod, go.sum), 129 insertions / 144 deletions.

Closes: GHSA-x744-4wpc-v9h2, CVE-2026-34040

2026-05-05 18:34:31 +00:00

5.6 KiB

Raw Blame History

View Raw