[ehl-jf]

Summary

Routine security-driven dependency bump. Minor + patch only, no major version bumps on same-path modules.

Includes an import path migration for testcontainers-go v0.42, which relocated container.HostConfig and mount.Mount from github.com/docker/docker/api/types/{container,mount} to github.com/moby/moby/api/types/{container,mount}. utils/tests/container.go and docker_test.go were updated to match; github.com/moby/moby/api is now a direct dependency and github.com/docker/docker is no longer required directly.

Modules bumped

Direct

• github.com/gocarina/gocsv: v0.0.0-20240520201108-78e41c74b4b1 → v0.0.0-20260523204920-c264028e67ea
• github.com/jfrog/jfrog-cli-security: v1.29.0 → v1.29.2
• github.com/moby/moby/api: v1.54.2 (newly direct, promoted from indirect)
• github.com/testcontainers/testcontainers-go: v0.40.0 → v0.42.0
• golang.org/x/exp: v0.0.0-20260410095643-746e56fc9e2f → v0.0.0-20260527015227-08cc5374adb3
• github.com/docker/docker: removed (no longer used directly after the testcontainers-go migration)

Indirect

• github.com/CycloneDX/cyclonedx-go: v0.10.0 → v0.11.0
• github.com/Masterminds/semver/v3: v3.4.0 → v3.5.0
• github.com/andybalholm/brotli: v1.2.0 → v1.2.1
• github.com/docker/cli: v29.3.0+incompatible → v29.5.2+incompatible
• github.com/docker/docker-credential-helpers: v0.9.3 → v0.9.7
• github.com/docker/go-connections: v0.6.0 → v0.7.0
• github.com/ebitengine/purego: v0.8.4 → v0.10.1
• github.com/fatih/color: v1.18.0 → v1.19.0
• github.com/fsnotify/fsnotify: v1.9.0 → v1.10.1
• github.com/go-ole/go-ole: v1.2.6 → v1.3.0
• github.com/go-openapi/analysis: v0.25.0 → v0.25.1
• github.com/go-openapi/jsonpointer: v0.22.5 → v0.23.1
• github.com/go-openapi/runtime: v0.29.3 → v0.32.1 (plus new runtime/server-middleware v0.32.1)
• github.com/go-openapi/swag and all swag subpackages: v0.25.5 → v0.26.0
• github.com/google/go-containerregistry: v0.21.3 → v0.21.6
• github.com/grokify/mogo: v0.74.0 → v0.74.5
• github.com/grpc-ecosystem/grpc-gateway/v2: v2.28.0 → v2.29.0
• github.com/hashicorp/go-plugin: v1.6.3 → v1.8.0
• github.com/hashicorp/yamux: v0.1.1 → v0.1.2
• github.com/klauspost/compress: v1.18.5 → v1.18.6
• github.com/ktrysmt/go-bitbucket: v0.9.88 → v0.10.0
• github.com/lufia/plan9stats: dated bump
• github.com/mattn/go-isatty: v0.0.20 → v0.0.22
• github.com/mattn/go-runewidth: v0.0.21 → v0.0.23
• github.com/mattn/go-tty: v0.0.7 → v0.0.8
• github.com/moby/go-archive: v0.1.0 → v0.2.0
• github.com/moby/moby/client: v0.3.0 → v0.4.1
• github.com/moby/patternmatcher: v0.6.0 → v0.6.1
• github.com/nwaples/rardecode/v2: v2.2.2 → v2.2.3
• github.com/oklog/run: v1.0.0 → v1.2.0
• github.com/owenrumney/go-sarif/v3: v3.2.3 → v3.3.0
• github.com/package-url/packageurl-go: v0.1.3 → v0.1.6
• github.com/pelletier/go-toml/v2: v2.3.0 → v2.3.1
• github.com/power-devops/perfstat: dated bump
• github.com/secure-systems-lab/go-securesystemslib: v0.10.0 → v0.11.0
• github.com/shirou/gopsutil/v4: v4.25.6 → v4.26.4
• github.com/sigstore/protobuf-specs: v0.5.0 → v0.5.1
• github.com/sigstore/rekor: v1.5.1 → v1.5.2
• github.com/sigstore/sigstore: v1.10.5 → v1.10.6
• github.com/sigstore/timestamp-authority/v2: v2.0.6 → v2.1.0
• github.com/theupdateframework/go-tuf/v2: v2.4.1 → v2.4.2
• github.com/tklauser/go-sysconf: v0.3.12 → v0.4.0
• github.com/tklauser/numcpus: v0.6.1 → v0.12.0
• github.com/vbatts/tar-split: v0.12.2 → v0.12.3
• github.com/vbauerster/mpb/v8: v8.12.0 → v8.12.1
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp: v0.64.0 → v0.68.0
• go.opentelemetry.io/otel, otel/metric, otel/trace: v1.42.0 → v1.43.0
• go.yaml.in/yaml/v2: v2.4.3 → v2.4.4
• golang.org/x/crypto: v0.50.0 → v0.52.0
• golang.org/x/mod: v0.35.0 → v0.36.0
• golang.org/x/net: v0.53.0 → v0.55.0
• golang.org/x/sys: v0.44.0 → v0.45.0
• google.golang.org/genproto/googleapis/api and .../rpc: dated bumps
• google.golang.org/grpc: v1.79.3 → v1.81.1
• google.golang.org/protobuf: v1.36.11 → v1.36.12-0.20260120151049-f2248ac996af
• gopkg.in/ini.v1: v1.67.1 → v1.67.2
• helm.sh/helm/v3: v3.19.2 → v3.21.0
• k8s.io/client-go: v0.34.0 → v0.36.1
• Removed unused indirects: containerd/stargz-snapshotter/estargz, docker/distribution, mitchellh/go-homedir, morikuni/aec, otel/exporters/otlp/otlptrace/otlptracehttp

Validation

• go test ./... — passed locally (322 tests passed, 650 skipped, 145 packages)
• go vet -v ./... — passed locally

---

• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• The pull request is targeting the master branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....

---

[github-actions]

---

🐸 JFrog Frogbot