Fix CVEs in Version v1.10.0

[FrankAnk]

Trivy detects CVEs in Version v1.10.0,
most of them can be fixed by upgrading stdlib from "1.26.0" to "1.26.1" and docker from "v28.5.2+incompatible" to "29.3.1"

• https://avd.aquasec.com/nvd/cve-2026-25679
• https://avd.aquasec.com/nvd/cve-2026-27137
• https://avd.aquasec.com/nvd/cve-2026-27142
• https://avd.aquasec.com/nvd/cve-2026-27138
• https://avd.aquasec.com/nvd/cve-2026-27139

[shueybubbles]

some of those links give 404

[FrankAnk]

Yes correct. Some seem to have been removed.
I`ve corrected the list.

[dlevy-msft-sql]

Thanks for the detailed report. Here's where things stand:

• stdlib CVEs (CVE-2026-25679, CVE-2026-27137, CVE-2026-27142, CVE-2026-27138, CVE-2026-27139): These were reported against v1.10.0 which was built with Go 1.26.0. The main branch is currently on Go 1.25.9 and govulncheck reports no known vulnerabilities. We'll evaluate upgrading the Go toolchain for the next release to pick up the stdlib fixes.

• Docker CVEs: The deprecated github.com/docker/docker dependency has already been removed from main and replaced with the supported github.com/moby/moby modules (Migrate off deprecated github.com/docker/docker to supported Docker/Moby SDK modules #727, now closed).

We're tracking this for the next release. govulncheck is now part of our CI pipeline to catch these proactively going forward.