From d8743e911127a9bc594086012043315b7f45bc71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Tue, 3 Nov 2026 20:53:29 +0100 Subject: [PATCH] chore: drop the trivyignore entries for npm's bundled packages Both covered copies inside the npm CLI of the Node base image. The runner removes npm, so neither CVE matches anything in the image; a scan of the built image with an empty ignore file reports neither. --- .trivyignore | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/.trivyignore b/.trivyignore index 34a98f1b7..d8ad25576 100644 --- a/.trivyignore +++ b/.trivyignore @@ -3,25 +3,6 @@ # can apply; never suppress one with a fixed version available — bump instead. # Each entry names what it covers and the condition to re-check / remove it. -# CVE-2026-33671 (picomatch ReDoS, HIGH) — flagged only in the npm CLI's -# OWN bundled copy that ships inside the Node base image -# (usr/local/lib/node_modules/npm/node_modules/picomatch, v4.0.3), used at -# image-build time by npm, not by our runtime. Our application dependency -# tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is -# not affected and the path is not reachable at runtime. Re-check when the -# Node base image ships an npm build whose bundled picomatch is >= 4.0.4, -# then drop this entry. -CVE-2026-33671 - -# CVE-2026-48815 (sigstore certificate-OID verification, HIGH) — flagged only -# in the npm CLI's OWN bundled copy inside the Node base image -# (usr/local/lib/node_modules/npm/node_modules/sigstore, v3.1.0). npm uses -# sigstore for publish provenance at image-build time only; it is not in our -# application dependency tree at all (`pnpm why sigstore` is empty) and is -# never reachable at runtime. Re-check when the Node base image ships an npm -# build whose bundled sigstore is >= 4.1.1, then drop this entry. -CVE-2026-48815 - # CVE-2026-85393 (node-forge RSA PKCS#1 v1.5 signature forgery, HIGH; GitHub # advisory GHSA-86w9-cpqp-85rv) — node-forge <= 1.4.0 arrives only through # @parse/node-apn, which uses it in its certificate-based credential path