Drop docker/docker by bumping toolhive v0.29.0#809
Merged
Conversation
`toolhive` v0.29.0 migrates its container runtime off the deprecated,
frozen `github.com/docker/docker` module onto the maintained
`github.com/moby/moby/{client,api}` modules (stacklok/toolhive#5420).
Bumping to it removes `github.com/docker/docker` from this project's
build entirely: it is no longer a production import and drops out of
`go.mod` (it lingers only as an indirect `go.sum` checksum via the
module graph). That resolves the `GO-2026-4883` / `GO-2026-4887`
(`CVE-2026-33997` / `CVE-2026-34040`) Docker daemon advisories whose
suppressions were already removed ahead of this bump, so both the
govulncheck and Grype scans stop reporting them.
Refresh the now-satisfied "until the bump lands" notes in
`.github/workflows/security-scan.yml` and `.grype.yaml`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
govulncheck reports `GO-2026-5037`, `GO-2026-5038` and `GO-2026-5039` — Go standard library advisories in `crypto/x509`, `mime` and `net/textproto`, fixed in Go 1.26.4. CI installs Go via `stable`, which currently resolves 1.26.3 because the actions/go-versions manifest has not published 1.26.4 yet, so these fire on every run. Ignore the three temporarily so the security scan reflects only actionable findings. Remove the entries once `stable` picks up 1.26.4 and we have confirmed govulncheck is clean against it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #809 +/- ##
=======================================
Coverage ? 61.77%
=======================================
Files ? 109
Lines ? 10555
Branches ? 0
=======================================
Hits ? 6520
Misses ? 3454
Partials ? 581 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
JAORMX
previously approved these changes
Jun 3, 2026
`anchore/scan-action` v7.4.0 bundles grype 0.110.0, whose syft catalogs Go modules from `go.sum`. After the toolhive v0.29.0 bump removed `github.com/docker/docker` from `go.mod` and the build, it remains only as a `go.sum` checksum (module graph via indirect deps), and 0.110.0 still flags it for `CVE-2026-34040` (`GHSA-x744-4wpc-v9h2`, high). Pin `grype-version: v0.112.0`, whose syft catalogs from `go.mod` only, so the Grype Repository Scan reflects the actual build — verified locally to return zero matches. govulncheck already confirms the advisory is not reachable. Drop the pin once scan-action ships a release bundling grype >= 0.112.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The earlier `grype-version` pin did not help: CI's Grype repository scan catalogs Go modules from `go.sum`, so it flags `github.com/docker/docker` (`GHSA-x744-4wpc-v9h2` / `CVE-2026-34040`, high) regardless of the grype version — confirmed by the code-scanning alert. The toolhive v0.29.0 bump removed the module from `go.mod` and the build (govulncheck is clean), but it persists as a `go.sum` checksum via `golang-migrate` and `ory/x`. Revert the ineffective pin and add a temporary, scoped `.grype.yaml` ignore for the advisory, documented as a go.sum-only false positive to be removed once `docker/docker` leaves `go.sum`. govulncheck needs no matching entry — it is build/reachability based. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
JAORMX
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
github.com/stacklok/toolhivev0.28.3 → v0.29.0, which removesgithub.com/docker/dockerfrom this project's build.v0.29.0 migrates toolhive's container runtime off the deprecated, frozen
docker/dockermodule onto the maintainedgithub.com/moby/moby/{client,api}modules (stacklok/toolhive#5420). With that, nothing in registry-server's import graph pullsdocker/dockeranymore, so it drops out of the production build andgo.modentirely (it remains only as an indirectgo.sumchecksum via the module graph).This completes the remediation that #805 set up: #805 removed the
GO-2026-4883/GO-2026-4887(CVE-2026-33997/CVE-2026-34040) docker daemon-advisory suppressions ahead of this bump (with a note that the scans were expected to fail until it landed). This is that bump.Verification (local)
go build ./...✓,go vet ./...✓ — no breaking changes from the minor bumpdocker/dockerin production build: 0 packages;go mod why→ "main module does not need package"; gone fromgo.mod--only-fixed --fail-on high, matching CI): nodocker/docker/ high+fixed findings → exit 0 — the Grype Repository Scan will passdocker/dockerfindings (the advisories are off the build)security-scan.ymland.grype.yamlNote on the
Go Vulnerability CheckjobIt will likely stay red on the pre-existing stdlib batch
GO-2026-5037/5038/5039(crypto/x509,mime,net/textproto; fixed in Go 1.26.4), reached via this project's own code. That's unrelated to this bump — it's red onmainfor the same reason, pending CI's Go toolchain reaching 1.26.4 (the Actionsgo-versionsmanifest still tops out at 1.26.3). This PR only removes the docker advisories from the reported set.🤖 Generated with Claude Code