From 0cb193f812e4d80cd0d0fd02270b1bc161141c05 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 2 Oct 2026 21:06:37 +0200 Subject: [PATCH] chore(deps): carry the node-forge advisory in the Trivy ignore list too Same advisory, same reasoning as the pnpm audit entry: the affected signature verification sits in node-apn's certificate credential path, which token-authenticated APNs never reaches, and no fix is published. --- .trivyignore | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.trivyignore b/.trivyignore index 829fa1515..ccf17286e 100644 --- a/.trivyignore +++ b/.trivyignore @@ -21,3 +21,13 @@ CVE-2026-33671 # never reachable at runtime. Re-check when the Node base image ships an npm # build whose bundled sigstore is >= 4.1.1, then drop this entry. CVE-2026-48815 + +# CVE-2026-85393 (node-forge RSA PKCS#1 v1.5 signature forgery, HIGH; GitHub +# advisory GHSA-86w9-cpqp-85rv) — node-forge <= 1.4.0 arrives only through +# @parse/node-apn, which uses it in its certificate-based credential path +# (credentials/certificate/*: p12 / PEM certificate). HealthLog authenticates +# to APNs with a token (.p8 key via APNS_KEY_ID / APNS_TEAM_ID), so that code +# never runs. No fixed release is published (latest is 1.4.0). Remove this +# entry, the matching `auditConfig.ignoreGhsas` entry in pnpm-workspace.yaml, +# and raise the floor once node-forge 1.4.1 is out. +CVE-2026-85393