# Trivy vulnerability ignore list.
# One CVE id per line. Only suppress a finding that has NO upstream fix we
# can apply; never suppress one with a fixed version available — bump instead.
# Each entry names what it covers and the condition to re-check / remove it.

# CVE-2026-33671 (picomatch ReDoS, HIGH) — flagged only in the npm CLI's
# OWN bundled copy that ships inside the Node base image
# (usr/local/lib/node_modules/npm/node_modules/picomatch, v4.0.3), used at
# image-build time by npm, not by our runtime. Our application dependency
# tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is
# not affected and the path is not reachable at runtime. Re-check when the
# Node base image ships an npm build whose bundled picomatch is >= 4.0.4,
# then drop this entry.
CVE-2026-33671

# CVE-2026-48815 (sigstore certificate-OID verification, HIGH) — flagged only
# in the npm CLI's OWN bundled copy inside the Node base image
# (usr/local/lib/node_modules/npm/node_modules/sigstore, v3.1.0). npm uses
# sigstore for publish provenance at image-build time only; it is not in our
# application dependency tree at all (`pnpm why sigstore` is empty) and is
# never reachable at runtime. Re-check when the Node base image ships an npm
# build whose bundled sigstore is >= 4.1.1, then drop this entry.
CVE-2026-48815

# CVE-2026-85393 (node-forge RSA PKCS#1 v1.5 signature forgery, HIGH; GitHub
# advisory GHSA-86w9-cpqp-85rv) — node-forge <= 1.4.0 arrives only through
# @parse/node-apn, which uses it in its certificate-based credential path
# (credentials/certificate/*: p12 / PEM certificate). HealthLog authenticates
# to APNs with a token (.p8 key via APNS_KEY_ID / APNS_TEAM_ID), so that code
# never runs. No fixed release is published (latest is 1.4.0). Remove this
# entry, the matching `auditConfig.ignoreGhsas` entry in pnpm-workspace.yaml,
# and raise the floor once node-forge 1.4.1 is out.
CVE-2026-85393

# braces <= 3.0.3 stack overflow on deeply nested patterns (CVE-2026-93687).
# braces arrives only through micromatch -> fast-glob in development tools
# (@next/eslint-plugin-next, @ts-morph/common, the shadcn CLI); `pnpm why
# braces --prod` is empty and the production image does not contain it, and
# those tools only expand patterns written in this repository. No fixed
# release is published (latest is 3.0.3). Remove this entry once one is.
CVE-2026-93687