mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
168a8ea5c5
The finding is npm's OWN bundled sigstore (v3.1.0) inside the Node base image, used for publish provenance at build time only. It is not in our application dependency tree and is unreachable at runtime — same class as the already-suppressed picomatch entry. Re-check when the base image ships an npm with sigstore >= 4.1.1.
24 lines
1.3 KiB
Plaintext
24 lines
1.3 KiB
Plaintext
# Trivy vulnerability ignore list.
|
|
# One CVE id per line. Only suppress a finding that has NO upstream fix we
|
|
# can apply; never suppress one with a fixed version available — bump instead.
|
|
# Each entry names what it covers and the condition to re-check / remove it.
|
|
|
|
# CVE-2026-33671 (picomatch ReDoS, HIGH) — flagged only in the npm CLI's
|
|
# OWN bundled copy that ships inside the Node base image
|
|
# (usr/local/lib/node_modules/npm/node_modules/picomatch, v4.0.3), used at
|
|
# image-build time by npm, not by our runtime. Our application dependency
|
|
# tree pins picomatch >= 4.0.4 via a pnpm override, so the running app is
|
|
# not affected and the path is not reachable at runtime. Re-check when the
|
|
# Node base image ships an npm build whose bundled picomatch is >= 4.0.4,
|
|
# then drop this entry.
|
|
CVE-2026-33671
|
|
|
|
# CVE-2026-48815 (sigstore certificate-OID verification, HIGH) — flagged only
|
|
# in the npm CLI's OWN bundled copy inside the Node base image
|
|
# (usr/local/lib/node_modules/npm/node_modules/sigstore, v3.1.0). npm uses
|
|
# sigstore for publish provenance at image-build time only; it is not in our
|
|
# application dependency tree at all (`pnpm why sigstore` is empty) and is
|
|
# never reachable at runtime. Re-check when the Node base image ships an npm
|
|
# build whose bundled sigstore is >= 4.1.1, then drop this entry.
|
|
CVE-2026-48815
|