mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
d8743e9111
Both covered copies inside the npm CLI of the Node base image. The runner removes npm, so neither CVE matches anything in the image; a scan of the built image with an empty ignore file reports neither.
23 lines
1.3 KiB
Plaintext
23 lines
1.3 KiB
Plaintext
# Trivy vulnerability ignore list.
|
|
# One CVE id per line. Only suppress a finding that has NO upstream fix we
|
|
# can apply; never suppress one with a fixed version available — bump instead.
|
|
# Each entry names what it covers and the condition to re-check / remove it.
|
|
|
|
# CVE-2026-85393 (node-forge RSA PKCS#1 v1.5 signature forgery, HIGH; GitHub
|
|
# advisory GHSA-86w9-cpqp-85rv) — node-forge <= 1.4.0 arrives only through
|
|
# @parse/node-apn, which uses it in its certificate-based credential path
|
|
# (credentials/certificate/*: p12 / PEM certificate). HealthLog authenticates
|
|
# to APNs with a token (.p8 key via APNS_KEY_ID / APNS_TEAM_ID), so that code
|
|
# never runs. No fixed release is published (latest is 1.4.0). Remove this
|
|
# entry, the matching `auditConfig.ignoreGhsas` entry in pnpm-workspace.yaml,
|
|
# and raise the floor once node-forge 1.4.1 is out.
|
|
CVE-2026-85393
|
|
|
|
# braces <= 3.0.3 stack overflow on deeply nested patterns (CVE-2026-93687).
|
|
# braces arrives only through micromatch -> fast-glob in development tools
|
|
# (@next/eslint-plugin-next, @ts-morph/common, the shadcn CLI); `pnpm why
|
|
# braces --prod` is empty and the production image does not contain it, and
|
|
# those tools only expand patterns written in this repository. No fixed
|
|
# release is published (latest is 3.0.3). Remove this entry once one is.
|
|
CVE-2026-93687
|