From 168a8ea5c54d0d5255b65c63ed1546941750a6c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Thu, 9 Jul 2026 10:06:20 +0200
Subject: [PATCH] chore(security): suppress npm-bundled sigstore CVE-2026-48815
 in trivy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The finding is npm's OWN bundled sigstore (v3.1.0) inside the Node base
image, used for publish provenance at build time only. It is not in our
application dependency tree and is unreachable at runtime — same class as the
already-suppressed picomatch entry. Re-check when the base image ships an npm
with sigstore >= 4.1.1.
---
 .trivyignore | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.trivyignore b/.trivyignore
index d0310907a..829fa1515 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -12,3 +12,12 @@
 # Node base image ships an npm build whose bundled picomatch is >= 4.0.4,
 # then drop this entry.
 CVE-2026-33671
+
+# CVE-2026-48815 (sigstore certificate-OID verification, HIGH) — flagged only
+# in the npm CLI's OWN bundled copy inside the Node base image
+# (usr/local/lib/node_modules/npm/node_modules/sigstore, v3.1.0). npm uses
+# sigstore for publish provenance at image-build time only; it is not in our
+# application dependency tree at all (`pnpm why sigstore` is empty) and is
+# never reachable at runtime. Re-check when the Node base image ships an npm
+# build whose bundled sigstore is >= 4.1.1, then drop this entry.
+CVE-2026-48815