Problem
osv-scalibr depends on github.com/docker/docker v28.2.2+incompatible. This module path is effectively dead — the last version published under it is v28.5.2+incompatible. Docker v29+ moved to new, separate Go modules under github.com/moby/moby/*:
github.com/moby/moby/client (currently v0.5.0)github.com/moby/moby/api (currently v1.55.0)
Because the old module path can't go past v28.5.2, consumers of osv-scalibr are stuck with several unfixed CVEs in docker/docker:
| CVE |
CVSS |
Title |
| CVE-2026-34040 |
7.8 |
Moby authorization bypass |
| CVE-2026-33997 |
8.1 |
Privilege validation bypass during plugin installation |
| CVE-2026-41567 |
7.2 |
PUT /containers/{id}/archive executes container binary on host |
| CVE-2026-42306 |
7.2 |
Race condition in docker cp allows bind mount redirection |
| CVE-2026-41568 |
6.1 |
Race condition in docker cp allows arbitrary empty file creation |
CVE-2026-34040 and CVE-2026-33997 are fixed in Docker v29.3.1. The other three have no fix yet, but staying on the dead module path means we also can't pick up future patches when they land.
What needs to change
The usage is limited to 8 files, all under extractor/standalone/containers/docker/ and artifact/image/layerscanning/image/:
github.com/docker/docker/client → github.com/moby/moby/client (2 files)github.com/docker/docker/api/types/container → github.com/moby/moby/api/types/container (7 files)
The packages exist under the new module paths with the same API surface.
Problem
osv-scalibrdepends ongithub.com/docker/dockerv28.2.2+incompatible. This module path is effectively dead — the last version published under it is v28.5.2+incompatible. Docker v29+ moved to new, separate Go modules undergithub.com/moby/moby/*:github.com/moby/moby/client(currently v0.5.0)github.com/moby/moby/api(currently v1.55.0)Because the old module path can't go past v28.5.2, consumers of osv-scalibr are stuck with several unfixed CVEs in
docker/docker:PUT /containers/{id}/archiveexecutes container binary on hostdocker cpallows bind mount redirectiondocker cpallows arbitrary empty file creationCVE-2026-34040 and CVE-2026-33997 are fixed in Docker v29.3.1. The other three have no fix yet, but staying on the dead module path means we also can't pick up future patches when they land.
What needs to change
The usage is limited to 8 files, all under
extractor/standalone/containers/docker/andartifact/image/layerscanning/image/:github.com/docker/docker/client→github.com/moby/moby/client(2 files)github.com/docker/docker/api/types/container→github.com/moby/moby/api/types/container(7 files)The packages exist under the new module paths with the same API surface.