From 717af848768ab450f5b3b8a26388b71e550975d3 Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 18:17:44 +0100
Subject: [PATCH 01/11] update examples

---
 examples/docker-compose/dozzle/compose.yaml     | 2 +-
 examples/docker-compose/watchtower/compose.yaml | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/examples/docker-compose/dozzle/compose.yaml b/examples/docker-compose/dozzle/compose.yaml
index 29a041d..8177e41 100644
--- a/examples/docker-compose/dozzle/compose.yaml
+++ b/examples/docker-compose/dozzle/compose.yaml
@@ -24,7 +24,7 @@ services:
       - docker-proxynet
 
   dozzle:
-    image: amir20/dozzle:v8.14 # make sure you use the most recent version
+    image: amir20/dozzle:v10.0 # make sure you use the most recent version
     user: 65534:65534
     read_only: true
     mem_limit: 256M
diff --git a/examples/docker-compose/watchtower/compose.yaml b/examples/docker-compose/watchtower/compose.yaml
index 7b6074f..1e15dc9 100644
--- a/examples/docker-compose/watchtower/compose.yaml
+++ b/examples/docker-compose/watchtower/compose.yaml
@@ -10,6 +10,7 @@ services:
       - '-allowGET=/v1\..{2}/(containers/.*|images/.*)'
       - '-allowPOST=/v1\..{2}/(containers/.*|images/.*|networks/.*)'
       - '-allowDELETE=/v1\..{2}/(containers/.*|images/.*)'
+      - '-allowHEAD=/_ping'
       # check socket connection every hour and stop the proxy if it fails (will then be restarted by docker):
       - '-watchdoginterval=3600'
       - '-stoponwatchdog'
@@ -29,7 +30,8 @@ services:
       - docker-proxynet
 
   watchtower:
-    image: containrrr/watchtower:1.7.1
+    # image: containrrr/watchtower:1.7.1
+    image: ghcr.io/nicholas-fedor/watchtower:1.14.2 # the containrrr repo is no longer maintained
     depends_on:
       - dockerproxy
     command:

From 85ec91735c3359fbb13e6849d067fa6182b435c9 Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 18:18:21 +0100
Subject: [PATCH 02/11] prepare new version in README

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5eaa8bf..5aebb80 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # socket-proxy
 
 ## Latest image
-- `wollomatic/socket-proxy:1.11.2` / `ghcr.io/wollomatic/socket-proxy:1.11.2`
+- `wollomatic/socket-proxy:1.11.3` / `ghcr.io/wollomatic/socket-proxy:1.11.3`
 - `wollomatic/socket-proxy:1` / `ghcr.io/wollomatic/socket-proxy:1`
 
 > [!IMPORTANT]

From 5cf727b66bfb70594d4070c66449f1e1652c2069 Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 18:28:28 +0100
Subject: [PATCH 03/11] add information about archived watchtower repo

---
 examples/docker-compose/watchtower/compose.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/examples/docker-compose/watchtower/compose.yaml b/examples/docker-compose/watchtower/compose.yaml
index 1e15dc9..8521203 100644
--- a/examples/docker-compose/watchtower/compose.yaml
+++ b/examples/docker-compose/watchtower/compose.yaml
@@ -31,6 +31,8 @@ services:
 
   watchtower:
     # image: containrrr/watchtower:1.7.1
+    # https://github.com/containrrr/watchtower was archived on December 17, 2025.
+    # https://github.com/nicholas-fedor/watchtower ist a maintained fork.
     image: ghcr.io/nicholas-fedor/watchtower:1.14.2 # the containrrr repo is no longer maintained
     depends_on:
       - dockerproxy

From c60cef05957d44a78031b23f86ccce7b3559f968 Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 18:33:22 +0100
Subject: [PATCH 04/11] fix typo

---
 examples/docker-compose/watchtower/compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/docker-compose/watchtower/compose.yaml b/examples/docker-compose/watchtower/compose.yaml
index 8521203..860e310 100644
--- a/examples/docker-compose/watchtower/compose.yaml
+++ b/examples/docker-compose/watchtower/compose.yaml
@@ -32,7 +32,7 @@ services:
   watchtower:
     # image: containrrr/watchtower:1.7.1
     # https://github.com/containrrr/watchtower was archived on December 17, 2025.
-    # https://github.com/nicholas-fedor/watchtower ist a maintained fork.
+    # https://github.com/nicholas-fedor/watchtower is a maintained fork.
     image: ghcr.io/nicholas-fedor/watchtower:1.14.2 # the containrrr repo is no longer maintained
     depends_on:
       - dockerproxy

From 4e3271b51ae74988474ac827ffcde145c301ff8d Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Sat, 21 Feb 2026 17:46:30 +0000
Subject: [PATCH 05/11] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/codeql.yml                | 78 +++++++++++++++++++++
 .github/workflows/dependency-review.yml     | 27 +++++++
 .github/workflows/docker-image-release.yaml | 18 ++---
 .github/workflows/docker-image-testing.yaml | 18 ++---
 .pre-commit-config.yaml                     | 14 ++++
 Dockerfile                                  |  2 +-
 6 files changed, 138 insertions(+), 19 deletions(-)
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 .github/workflows/dependency-review.yml
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..884bff6
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,78 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["go"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
+        with:
+          category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..c7a7acb
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,27 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.8.3
diff --git a/.github/workflows/docker-image-release.yaml b/.github/workflows/docker-image-release.yaml
index 0622d7b..f8b9174 100644
--- a/.github/workflows/docker-image-release.yaml
+++ b/.github/workflows/docker-image-release.yaml
@@ -17,15 +17,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
+        uses: securego/gosec@f3e2fac4d58b7eca54307cd40ce2a836a12e4d95 # master
         with:
           args: ./...
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: '1.25'
 
@@ -37,28 +37,28 @@ jobs:
         run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.0.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
         with:
           cosign-release: 'v2.6.1'
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker Hub image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         id: push-dockerhub
         with:
           context: .
@@ -76,7 +76,7 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
 
       - name: Build and push GHCR image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         id: push-ghcr
         with:
           context: .
diff --git a/.github/workflows/docker-image-testing.yaml b/.github/workflows/docker-image-testing.yaml
index 8f3a632..7c9c997 100644
--- a/.github/workflows/docker-image-testing.yaml
+++ b/.github/workflows/docker-image-testing.yaml
@@ -19,15 +19,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
+        uses: securego/gosec@f3e2fac4d58b7eca54307cd40ce2a836a12e4d95 # master
         with:
           args: ./...
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: '1.25'
 
@@ -40,23 +40,23 @@ jobs:
 #          cosign-release: 'v2.6.0'
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push image to Docker Hub and GHCR
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         id: push-all
         with:
           context: .
@@ -70,7 +70,7 @@ jobs:
             ghcr.io/wollomatic/socket-proxy:testing-${{ github.sha }}
 
 #      - name: Build and push Docker Hub image
-#        uses: docker/build-push-action@v6
+#        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
 #        id: push-dockerhub
 #        with:
 #          context: .
@@ -88,7 +88,7 @@ jobs:
 #          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
 #
 #      - name: Build and push GHCR image
-#        uses: docker/build-push-action@v6
+#        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
 #        id: push-ghcr
 #        with:
 #          context: .
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..919f2c4
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,14 @@
+repos:
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.16.3
+  hooks:
+  - id: gitleaks
+- repo: https://github.com/golangci/golangci-lint
+  rev: v1.52.2
+  hooks:
+  - id: golangci-lint
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
diff --git a/Dockerfile b/Dockerfile
index d0864a3..4bb4870 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM --platform=$BUILDPLATFORM golang:1.26.0-alpine3.23 AS build
+FROM --platform=$BUILDPLATFORM golang:1.26.0-alpine3.23@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 AS build
 WORKDIR /application
 COPY . ./
 ARG TARGETOS

From 00037a016cd1236ee46042de74913630cb3759c3 Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 19:10:12 +0100
Subject: [PATCH 06/11] we use the default CodeQL configuration

---
 .github/workflows/codeql.yml | 78 ------------------------------------
 1 file changed, 78 deletions(-)
 delete mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 884bff6..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,78 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
-
-on:
-  push:
-    branches: ["main"]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: ["main"]
-  schedule:
-    - cron: "0 0 * * 1"
-
-permissions:
-  contents: read
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ["go"]
-        # CodeQL supports [ $supported-codeql-languages ]
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
-        with:
-          languages: ${{ matrix.language }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-
-      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-      # If this step fails, then you should remove it and run the build manually (see below)
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
-
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-      #   If the Autobuild fails above, remove it and uncomment the following three lines.
-      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-      # - run: |
-      #   echo "Run, Build Application using script"
-      #   ./location_of_script_within_repo/buildscript.sh
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@45580472a5bb82c4681c4ac726cfdb60060c2ee1 # v3.32.4
-        with:
-          category: "/language:${{matrix.language}}"

From d1eba054ca928caa44a2a1f2881c304f84be7bdb Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 19:14:18 +0100
Subject: [PATCH 07/11] update tooling to Go 1.26, update Go syntax

---
 .github/workflows/docker-image-release.yaml   | 2 +-
 .github/workflows/docker-image-testing.yaml   | 2 +-
 go.mod                                        | 2 +-
 internal/docker/api/types/network/endpoint.go | 3 +--
 internal/docker/client/request.go             | 9 +++------
 5 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/docker-image-release.yaml b/.github/workflows/docker-image-release.yaml
index f8b9174..81d38ce 100644
--- a/.github/workflows/docker-image-release.yaml
+++ b/.github/workflows/docker-image-release.yaml
@@ -27,7 +27,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: '1.25'
+          go-version: '1.26'
 
       - name: Run Go tests
         run: go test ./...
diff --git a/.github/workflows/docker-image-testing.yaml b/.github/workflows/docker-image-testing.yaml
index 7c9c997..2fb1d1b 100644
--- a/.github/workflows/docker-image-testing.yaml
+++ b/.github/workflows/docker-image-testing.yaml
@@ -29,7 +29,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: '1.25'
+          go-version: '1.26'
 
       - name: Run Go tests
         run: go test ./...
diff --git a/go.mod b/go.mod
index aa43515..bebfd3d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/wollomatic/socket-proxy
 
-go 1.22.6
+go 1.26.0
diff --git a/internal/docker/api/types/network/endpoint.go b/internal/docker/api/types/network/endpoint.go
index 1fdec47..6caee49 100644
--- a/internal/docker/api/types/network/endpoint.go
+++ b/internal/docker/api/types/network/endpoint.go
@@ -20,6 +20,5 @@ type EndpointSettings struct {
 
 // Copy makes a deep copy of `EndpointSettings`
 func (es *EndpointSettings) Copy() *EndpointSettings {
-	epCopy := *es
-	return &epCopy
+	return new(*es)
 }
diff --git a/internal/docker/client/request.go b/internal/docker/client/request.go
index bc0f93e..addf8e6 100644
--- a/internal/docker/client/request.go
+++ b/internal/docker/client/request.go
@@ -72,18 +72,15 @@ func (cli *Client) doRequest(req *http.Request) (*http.Response, error) {
 			return nil, err
 		}
 
-		var uErr *url.Error
-		if errors.As(err, &uErr) {
-			var nErr *net.OpError
-			if errors.As(uErr.Err, &nErr) {
+		if uErr, ok := errors.AsType[*url.Error](err); ok {
+			if nErr, ok2 := errors.AsType[*net.OpError](uErr.Err); ok2 {
 				if os.IsPermission(nErr.Err) {
 					return nil, errConnectionFailed{fmt.Errorf("permission denied while trying to connect to the Docker daemon socket at %v: %v", cli.host, err)}
 				}
 			}
 		}
 
-		var nErr net.Error
-		if errors.As(err, &nErr) {
+		if nErr, ok := errors.AsType[net.Error](err); ok {
 			if nErr.Timeout() {
 				return nil, connectionFailed(cli.host)
 			}

From 188ab354727044938f8db012ea85924718259d0b Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 19:19:36 +0100
Subject: [PATCH 08/11] don't use pre-commit in this repo

---
 .pre-commit-config.yaml | 14 --------------
 1 file changed, 14 deletions(-)
 delete mode 100644 .pre-commit-config.yaml

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
deleted file mode 100644
index 919f2c4..0000000
--- a/.pre-commit-config.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-repos:
-- repo: https://github.com/gitleaks/gitleaks
-  rev: v8.16.3
-  hooks:
-  - id: gitleaks
-- repo: https://github.com/golangci/golangci-lint
-  rev: v1.52.2
-  hooks:
-  - id: golangci-lint
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.4.0
-  hooks:
-  - id: end-of-file-fixer
-  - id: trailing-whitespace

From e38f2b2c2c70cb9f94b1a3b7e35864adae6c8b5d Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 19:41:48 +0100
Subject: [PATCH 09/11] pin gosec to v2.23.0

---
 .github/workflows/docker-image-release.yaml | 2 +-
 .github/workflows/docker-image-testing.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-image-release.yaml b/.github/workflows/docker-image-release.yaml
index 81d38ce..c4a5f16 100644
--- a/.github/workflows/docker-image-release.yaml
+++ b/.github/workflows/docker-image-release.yaml
@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@f3e2fac4d58b7eca54307cd40ce2a836a12e4d95 # master
+        uses: securego/gosec@398ad549bbf1a51dc978fd966169f660c59774de # v2.23.0
         with:
           args: ./...
 
diff --git a/.github/workflows/docker-image-testing.yaml b/.github/workflows/docker-image-testing.yaml
index 2fb1d1b..95ff12b 100644
--- a/.github/workflows/docker-image-testing.yaml
+++ b/.github/workflows/docker-image-testing.yaml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@f3e2fac4d58b7eca54307cd40ce2a836a12e4d95 # master
+        uses: securego/gosec@398ad549bbf1a51dc978fd966169f660c59774de # v2.23.0
         with:
           args: ./...
 

From 0262553d554857265f90e8dd6a257642ae6ca68a Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 20:01:07 +0100
Subject: [PATCH 10/11] pin gosec to v2.23.0 version - try to fix weird
 behaviour

---
 .github/workflows/docker-image-release.yaml | 2 +-
 .github/workflows/docker-image-testing.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-image-release.yaml b/.github/workflows/docker-image-release.yaml
index c4a5f16..720ca4c 100644
--- a/.github/workflows/docker-image-release.yaml
+++ b/.github/workflows/docker-image-release.yaml
@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@398ad549bbf1a51dc978fd966169f660c59774de # v2.23.0
+        uses: securego/gosec@v2.23.0
         with:
           args: ./...
 
diff --git a/.github/workflows/docker-image-testing.yaml b/.github/workflows/docker-image-testing.yaml
index 95ff12b..0104fe1 100644
--- a/.github/workflows/docker-image-testing.yaml
+++ b/.github/workflows/docker-image-testing.yaml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@398ad549bbf1a51dc978fd966169f660c59774de # v2.23.0
+        uses: securego/gosec@v2.23.0
         with:
           args: ./...
 

From 5e0a708ee0d104d9a5b3b47c33ec902c08c6e36d Mon Sep 17 00:00:00 2001
From: wollomatic <git2026@wollomatic.dev>
Date: Sat, 21 Feb 2026 20:08:25 +0100
Subject: [PATCH 11/11] run gosec with Go 1.26

---
 .github/workflows/docker-image-release.yaml | 10 +++++-----
 .github/workflows/docker-image-testing.yaml | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/docker-image-release.yaml b/.github/workflows/docker-image-release.yaml
index 720ca4c..172a245 100644
--- a/.github/workflows/docker-image-release.yaml
+++ b/.github/workflows/docker-image-release.yaml
@@ -19,16 +19,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Run Gosec Security Scanner
-        uses: securego/gosec@v2.23.0
-        with:
-          args: ./...
-
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: '1.26'
 
+      - name: Run Gosec Security Scanner
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@v2.23.0
+          gosec ./...
+
       - name: Run Go tests
         run: go test ./...
 
diff --git a/.github/workflows/docker-image-testing.yaml b/.github/workflows/docker-image-testing.yaml
index 0104fe1..47d8516 100644
--- a/.github/workflows/docker-image-testing.yaml
+++ b/.github/workflows/docker-image-testing.yaml
@@ -21,16 +21,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Run Gosec Security Scanner
-        uses: securego/gosec@v2.23.0
-        with:
-          args: ./...
-
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
           go-version: '1.26'
 
+      - name: Run Gosec Security Scanner
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@v2.23.0
+          gosec ./...
+
       - name: Run Go tests
         run: go test ./...