The update for Docker includes multiple upstream version upgrades from 28.3.3-ce to 28.5.1-ce and docker-buildx from v0.26.0 to v0.29.0. It addresses a critical security vulnerability tracked as CVE-2025-54388, fixes a nil pointer panic in 'docker push', and modifies buildx usage on SLE systems to handle secret injection limitations. The update removes git-core recommends on SLE to prevent unnecessary git installation, as most users already have git installed. The docker CLI is patched to disable automatic 'docker buildx build' invocation, making DOCKER_BUILDKIT=0 the default, with users able to opt-in manually. Secret injection with docker-buildx requires specific Dockerfile and build command usage. These changes improve stability, security, and compatibility with SUSE environments.

The critical vulnerability CVE-2025-54388 fixed in Docker 28.3.3-ce and later versions could potentially allow attackers to exploit Docker Engine if left unpatched. The nil pointer panic fix in 'docker push' improves stability and prevents potential denial of service. Changes to docker-buildx behavior on SLE systems address compatibility and security concerns related to secret injection, reducing the risk of credential exposure or build failures. Overall, the update mitigates critical security risks and improves operational reliability.

A security update is available that addresses the critical vulnerability CVE-2025-54388 and other issues. Users should upgrade Docker Engine to version 28.3.3-ce or later and docker-buildx to version 0.29.0 or later. On SUSE Linux Enterprise systems, users should explicitly set DOCKER_BUILDKIT=0 to avoid automatic use of docker-buildx unless opting in manually. For secret injection with docker-buildx, users must follow the documented method using RUN --mount=type=secret and the appropriate buildx build command. No additional action is required beyond applying these updates and configuration changes.