Both covered copies inside the npm CLI of the Node base image. The
runner removes npm, so neither CVE matches anything in the image; a scan
of the built image with an empty ignore file reports neither.
Same advisory, same reasoning as the pnpm audit entry: the affected
signature verification sits in node-apn's certificate credential path,
which token-authenticated APNs never reaches, and no fix is published.
The finding is npm's OWN bundled sigstore (v3.1.0) inside the Node base
image, used for publish provenance at build time only. It is not in our
application dependency tree and is unreachable at runtime — same class as the
already-suppressed picomatch entry. Re-check when the base image ships an npm
with sigstore >= 4.1.1.
CVE-2026-33671 (picomatch ReDoS, HIGH) is flagged only in the npm CLI's
own bundled copy inside the Node base image, used at image-build time,
not by our runtime. Our app dependency tree pins picomatch >= 4.0.4 via
a pnpm override, so the running app is not affected. Re-check when the
base image ships an npm whose bundled picomatch is >= 4.0.4.
Marc-André Bombeck