fix(wren-launcher): upgrade docker package to resolve vulnerability issue

[wwwy3y3]

upgrade docker package to resolve vulnerability issue

Summary by CodeRabbit

• Chores
  • Updated Go language and toolchain versions.
  • Upgraded numerous dependencies to newer versions, including Docker, AWS SDK, containerd, Kubernetes, Prometheus, OpenTelemetry, and others.
  • Added and removed various supporting libraries to ensure compatibility and improved security.
  • No changes to user-facing features or functionality.

[coderabbitai]

Walkthrough

The update modifies the go.mod file for the wren-launcher project. It upgrades the Go language version from 1.23.0 to 1.23.8 and specifies the use of the Go 1.24.1 toolchain. Numerous dependencies are updated to more recent versions, with several new libraries added and some obsolete or replaced modules removed. These changes affect a wide range of dependencies, including Docker, AWS SDK, container management, Kubernetes, telemetry, cryptography, and utility packages. There are no changes to application code, logic, or public APIs; the modifications are limited solely to dependency and toolchain management.

Changes

File(s)	Summary of Changes
wren-launcher/go.mod	Updated Go version (1.23.0 → 1.23.8), specified toolchain (Go 1.24.1), upgraded numerous dependencies (Docker, AWS SDK, Kubernetes, telemetry, cryptography, etc.), added new libraries, removed/replaced some modules. No code or API changes.

Poem

In the warren of code, dependencies grow,
With a hop and a skip, old versions must go.
Go 1.24.1 now leads the bright way,
Fresh libraries bloom where the old ones decay.
No logic was changed, just a spring cleaning spree—
Now the launcher is lighter, as happy as me!
🐇✨

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

wren-launcher/go.mod (1)

183-190: Validate direct vs. indirect require blocks.

github.com/docker/cli v28.1.0+incompatible appears in the second require block (typically for indirect modules). Ensure:

• It’s a direct dependency (imported in your code) if kept here.
• Direct and indirect dependencies are clearly separated for readability.

Reorganize the require blocks so that only truly indirect modules are grouped in the lower section.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 841b264 and 6075c54.

⛔ Files ignored due to path filters (1)

• wren-launcher/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• wren-launcher/go.mod (2 hunks)

⏰ Context from checks skipped due to timeout of 90000ms (1)

• GitHub Check: Analyze (go)

🔇 Additional comments (2)

wren-launcher/go.mod (2)

3-5: Verify Go version and toolchain alignment.

You’ve bumped the module’s Go version to 1.23.8 and set the toolchain to go1.24.1. Confirm that:

• Your CI workflows and developer environments are updated to use Go ≥ 1.23.8 (or switch fully to 1.24).
• Any Dockerfiles or build scripts that pin an older Go image version are adjusted accordingly.

Please verify your CI configuration (e.g., GitHub Actions, Dockerfiles) reflects these new Go versions.

---

9-14:

Details

✅ Verification successful

Review Docker dependencies bump for compatibility.

You’ve upgraded key Docker modules:

• github.com/docker/compose/v2 → v2.35.1
• github.com/docker/docker → v28.1.0+incompatible

Additionally, in the later block you bumped:

• github.com/docker/cli → v28.1.0+incompatible

These are major-version or breaking changes. Please verify:

• APIs your code consumes haven’t changed (e.g., removed functions, renamed types).
• Any scripting or sample code is updated to match the new module interfaces.

Run a quick grep to spot potential breaking usages:

---

🏁 Script executed:

#!/bin/bash
rg -A2 "compose\\." -g '*.go'
rg -A2 "docker\\." -g '*.go'

Length of output: 3116

---

Docker dependencies bump – no issues detected

I ran a search for compose. and docker. in the Go code and found only:

• Instantiation of compose.NewComposeService(dockerCli)
• Static container label checks (com.docker.compose.*)
• URL constants for downloading compose files

None of these APIs appear to have changed in the upgraded modules. No further updates are needed.

[coderabbitai]

🛠️ Refactor suggestion

Trim indirect dependencies via go mod tidy.

The indirect-dependencies block has been extensively hand-edited. Instead of manually bumping all indirect modules, run:

go mod tidy

This will:

• Prune unused dependencies.
• Ensure indirect requirements are recorded correctly in go.sum.

Manual edits here can lead to drift and maintenance overhead.

Regenerate the dependency graph with minimal manual intervention.

🤖 Prompt for AI Agents (early access)

In wren-launcher/go.mod from lines 20 to 181, the indirect dependencies have been manually edited, which can cause maintenance issues and drift. To fix this, remove the manual changes and run the command 'go mod tidy' in the project root. This will automatically prune unused dependencies and correctly update the indirect requirements in go.sum, ensuring the dependency graph is accurate and minimal without manual intervention.