Dependencies still trigger CVE-2026-41568
Author: gelgin-v2Created Sep 15, 2026Updated Sep 15, 2026
Describe the Bug
The new release removed a number of pieces for the CVE, but the docker/docker package is still in go.sum. It seems to be from the dktest dependency.
Steps to Reproduce
Running a check for the CVE should show it still triggers. Also in the go.sum it shows the incompatible package.
Expected Behavior Expect the package to pass the CVE.
Migrate Version v4.20.1
Go Version 1.26.4
Source: golang-migrate/migrate