Docker CLI pinned below its patched version by a replace directive #6853

🤖 Generated by the Agentic Engineer

Evidence

The shared root go.mod, used by the CLI and tagged desktop entry point, carries a replace directive pinning the Docker CLI library down to a version that a published advisory lists as affected:

github.com/docker/cli => github.com/docker/cli v28.3.1+incompatible

The require line resolves to a current release, so the vulnerable version is visible only in the replace block — dependency dashboards that read require lines report this module as up to date. CodeRabbit's OSV scanner surfaced it on an unrelated dependency-bump PR (#6839), where it is out of diff.

The advisory is CVE-2025-15558 (GHSA-p436-gjf2-799p): an uncontrolled search path for CLI plugins on Windows allows a low-privileged local user to plant a binary that the Docker CLI then executes. Fixed upstream in v29.2.0.

Affected audience and impact

Assessed not reachable in KSail's build, so this is a supply-chain-scanner exposure rather than an exploitable path today:

• The module is // indirect in the shared root module — no KSail package imports it.
• The vulnerable code is the CLI plugin manager. KSail's Docker integration imports github.com/docker/docker/client, not github.com/docker/cli, and the repository contains no reference to the plugin-search path.

The cost while it stands is real but bounded: every vulnerability scan on this repository reports a Major finding that has to be re-triaged by hand, on every dependency PR that touches go.mod. That recurring triage is the actual impact.

Why it cannot simply be bumped

The pin is deliberate and documented in-file. Docker CLI v29 migrated to the split moby/moby/api + moby/moby/client modules, whose types are incompatible with the docker/docker monolith types that k3d still uses. Pinning to v28 keeps the whole dependency graph on one type system; moving to v29.2.0+ breaks the build.

Blocker: a k3d v5 release newer than v5.9.0 is published (k3d-io/k3d) | outcome | last-verified 2026-10-14: not shipped — v5.9.0 (2026-06-02) is still the latest k3d v5 release on the Go module proxy.

Expected behaviour

The effective Docker CLI version in the shared root module is at or above the patched release, with no replace override holding it below.

Acceptance criteria

• The github.com/docker/cli replace directive is removed from the shared root go.mod, or repointed at a version at or above the patched release.
• The CLI and desktop entry points build and the full test suite passes with the monolith/split type systems reconciled.
• A vulnerability scan of the repository reports no finding for this advisory.
• The in-file comment explaining the pin is removed along with it.

Rough size

Small once k3d moves; not startable before then. Re-check the blocker on each triage pass and unblock as soon as a k3d release drops the monolith types.

Generated by Claude Code