fix(docker): bump bundled docker CLI to 29.8.0 to clear Go stdlib HIGHs

[vieiralucas]

Summary

The Docker workflow has been red on main for the last three commits (9cc2c76b, 2409d691, 16820146). The scan job fails with Total: 6 (HIGH: 6, CRITICAL: 0) against usr/local/bin/docker (gobinary) — the bundled static Docker CLI. The image's Debian layer is clean (0 findings); the CLI is the sole source.

Root cause: DOCKER_CLI_VERSION=29.7.2 is compiled with go1.26.5, and the vulnerability DB now carries six HIGH Go stdlib advisories against it — CVE-2026-33818 (encoding/asn1 DoS), CVE-2026-56853 (net/http HTTP/2 DoS), CVE-2026-56858 (html/template XSS), CVE-2026-56859 (encoding/xml DoS), CVE-2026-56860 (net/url quadratic complexity), CVE-2026-56862 (crypto/tls KeyUpdate DoS). All are fixed in go1.26.6+. Nothing in the repo changed; the DB did.

Fix is the pin, not a suppression: Docker 29.8.0 (released 2026-09-03) is built with go1.26.8.

Test plan

Verified locally with Trivy 0.70.0 — the exact version the workflow pins — using the same flags (--severity HIGH,CRITICAL --ignore-unfixed):

• docker-29.8.0.tgz linux/amd64 static binary: go1.26.8, 0 vulnerabilities
• docker-29.8.0.tgz linux/arm64 static binary: go1.26.8, 0 vulnerabilities
• docker build --target docker-cli succeeds; the resulting stage reports Docker version 29.8.0, build 88096ef

Both arches matter because the image is built for linux/amd64 and linux/arm64.

.trivyignore is now entry-free. Its two previous suppressions (CVE-2026-39821, CVE-2026-46600) are stdlib-vendored golang.org/x/net issues also in the go1.26.5 advisory set and also fixed by go1.26.8, so dropping them un-gates nothing that is still present. The file itself is kept — .github/workflows/docker.yml passes trivyignores: .trivyignore and trivy-action hard-fails with cannot find ignorefile when the path is missing — and now documents when adding an entry is the right move versus bumping the pin.

Note: docker.yml runs on main/tags, not on PRs, so this PR's checks do not exercise the Trivy gate. That is why the verification above was done locally against both static builds. The workflow will run on main immediately after merge.

Surface impact

No user-facing behavior, API surface, service, or operation count changes — a build-stage version pin and a scanner config file. Checked and unchanged accordingly: reference docs, READMEs, all six language SDKs, website, LLM/agent content, machine metadata (conformance-baseline.json, ops index, parity counts), examples, GitHub repo description.

🤖 Generated with Claude Code

https://claude.ai/code/session_015paJopoDarw6WeFFoZMDMf

---

Summary by cubic

Bumps the bundled static Docker CLI from 29.7.2 to 29.8.0 so the image's Trivy gate passes again. The previous CLI shipped go1.26.5, which the vulnerability DB now flags with six HIGH Go stdlib advisories; 29.8.0 ships go1.26.8 and scans clean.

Verification

• Confirmed with Trivy 0.70.0 against both linux/amd64 and linux/arm64 static builds; each reports 0 HIGH/CRITICAL.
• The Docker workflow only runs on main/tags, so this PR's checks don't exercise the Trivy gate.
• Removes both suppressions from .trivyignore but keeps the file, since the workflow's trivy-action fails when the path is missing.

^{Written for commit 44fe354. Summary will update on new commits.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.