[Bug]: com.github.docker-java:docker-java-transport-zerodep pulls in apache httpcomponents which was tagged in CVE-2026-54428

[Wytzepakito]

Module

Core

Testcontainers version

2.05

Using the latest Testcontainers version?

Yes

Host OS

Mac

Host Arch

ARM

Docker version

Client: Docker Engine - Community
 Version:           29.6.2
 API version:       1.55
 Go version:        go1.26.5
 Git commit:        dfc4efb1e2
 Built:             Thu Jul 16 16:09:24 2026
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.83.0 (234302)
 Engine:
  Version:          29.6.2
  API version:      1.55 (minimum version 1.40)
  Go version:       go1.26.5
  Git commit:       3d80467
  Built:            Thu Jul 16 16:13:03 2026
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.2.5
  GitCommit:        e53c7c1516c3b2bff98eb76f1f4117477e6f4e66
 runc:
  Version:          1.3.6
  GitCommit:        v1.3.6-0-g491b69ba
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

What happened?

Please fix the security vulnerability

Relevant log output

Additional Information

No response

[kiview]

While this triggers CVE scanners, it is not exploitable in tc-java. docker-java has a PR open, that should mitigate this finding: docker-java/docker-java#2669