Migrate from github.com/docker/docker to github.com/moby/moby/client (v29 module path change)

This module still imports github.com/docker/docker, which was deprecated in Docker Engine v29.0.0 in favour of github.com/moby/moby/client and github.com/moby/moby/api.

As noted in the v29.0.0 release notes:

The Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api.

Because docker/buildx has not yet migrated, any Go project that transitively depends on docker/buildx (e.g. via testcontainers-go/modules/compose) is forced to carry github.com/docker/docker in its module graph. This is now causing security scanner alerts for CVE-2026-34040 and CVE-2026-33997, both fixed in moby/moby v29.3.1+ but only accessible via the new module path.

The dependency chain I'm currently facing issues with is for github.com/docker/docker v28.5.2+incompatible:

testcontainers-go/modules/compose
  └─ docker/compose/v5/pkg/compose
      └─ docker/buildx/store/storeutil
          └─ docker/buildx/store
              └─ github.com/docker/docker

There is no workaround available to downstream consumers — a replace directive cannot bridge a module path rename, and github.com/docker/docker stops at v28 on the Go module proxy.

Are there plans to migrate this module to use github.com/moby/moby/client and github.com/moby/moby/api instead of github.com/docker/docker, so that downstream projects can resolve these CVEs ?

Start by tracing the imports and Go module graph through buildx/store/storeutil and buildx/store, focusing on github.com/docker/docker and the proposed github.com/moby/moby/client and github.com/moby/moby/api paths. Done means docker/buildx no longer forces github.com/docker/docker v28.5.2+incompatible, and downstream projects can resolve the dependency versions containing the cited fixes.