2 Commits

Include renames

Author	SHA1	Message	Date
Marc-André Bombeck	168a8ea5c5	chore(security): suppress npm-bundled sigstore CVE-2026-48815 in trivy ... The finding is npm's OWN bundled sigstore (v3.1.0) inside the Node base image, used for publish provenance at build time only. It is not in our application dependency tree and is unreachable at runtime — same class as the already-suppressed picomatch entry. Re-check when the base image ships an npm with sigstore >= 4.1.1.	2026-07-09 10:06:20 +02:00
Marc-André Bombeck	b9035addf4	ci: ignore the npm-bundled picomatch CVE in the container scan ... CVE-2026-33671 (picomatch ReDoS, HIGH) is flagged only in the npm CLI's own bundled copy inside the Node base image, used at image-build time, not by our runtime. Our app dependency tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is not affected. Re-check when the base image ships an npm whose bundled picomatch is >= 4.0.4.	2026-06-18 15:15:14 +02:00