From 296ca5d2dc7de5c124d443474c0f118cc3261a44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sat, 3 Oct 2026 17:29:51 +0200 Subject: [PATCH] ci(trivy): ignore the braces advisory until a fix is published braces is reached only by development tooling and never ships in the production image; no patched version exists yet. --- .trivyignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.trivyignore b/.trivyignore index ccf17286e..34a98f1b7 100644 --- a/.trivyignore +++ b/.trivyignore @@ -31,3 +31,11 @@ CVE-2026-48815 # entry, the matching `auditConfig.ignoreGhsas` entry in pnpm-workspace.yaml, # and raise the floor once node-forge 1.4.1 is out. CVE-2026-85393 + +# braces <= 3.0.3 stack overflow on deeply nested patterns (CVE-2026-93687). +# braces arrives only through micromatch -> fast-glob in development tools +# (@next/eslint-plugin-next, @ts-morph/common, the shadcn CLI); `pnpm why +# braces --prod` is empty and the production image does not contain it, and +# those tools only expand patterns written in this repository. No fixed +# release is published (latest is 3.0.3). Remove this entry once one is. +CVE-2026-93687