From b9035addf40957223fcff47eea6999b801cb5698 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 18 Jun 2026 15:15:14 +0200 Subject: [PATCH] ci: ignore the npm-bundled picomatch CVE in the container scan CVE-2026-33671 (picomatch ReDoS, HIGH) is flagged only in the npm CLI's own bundled copy inside the Node base image, used at image-build time, not by our runtime. Our app dependency tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is not affected. Re-check when the base image ships an npm whose bundled picomatch is >= 4.0.4. --- .trivyignore | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000..d0310907a --- /dev/null +++ b/.trivyignore @@ -0,0 +1,14 @@ +# Trivy vulnerability ignore list. +# One CVE id per line. Only suppress a finding that has NO upstream fix we +# can apply; never suppress one with a fixed version available — bump instead. +# Each entry names what it covers and the condition to re-check / remove it. + +# CVE-2026-33671 (picomatch ReDoS, HIGH) — flagged only in the npm CLI's +# OWN bundled copy that ships inside the Node base image +# (usr/local/lib/node_modules/npm/node_modules/picomatch, v4.0.3), used at +# image-build time by npm, not by our runtime. Our application dependency +# tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is +# not affected and the path is not reachable at runtime. Re-check when the +# Node base image ships an npm build whose bundled picomatch is >= 4.0.4, +# then drop this entry. +CVE-2026-33671