.trivyignore

# .trivyignore — accepted-risk suppressions for the container image scan
#
# Policy (see docs/security/SUPPLY_CHAIN.md):
#   - The Trivy steps in .github/workflows/docker-publish.yml run with
#     `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
#     already excluded from both the blocking CRITICAL gate and the advisory
#     Security-tab upload. You do NOT need an entry here for an unfixable
#     base-image OS CVE — it will not be reported.
#   - This file is the single auditable home for the rare case where a *fixable*
#     CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
#     pinned base tag, or the affected package/binary is provably unreachable
#     from the proxy request surface and rebuilding now is not justified).
#
# Format — one CVE id per line, each with a justification comment and, where
# possible, an expiry, e.g.:
#   # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
#   CVE-XXXX-YYYY
#
# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
# patched base / bump the dep) over suppressing. Stale entries are debt.

# CVE-2026-118764 (minimatch 10.2.5, fix 11.0.1) and CVE-2026-118773 (glob 13.0.6, fix 14.0.2)
# live in the npm bundled in the image, and npm 12.2.1 (latest) still declares the
# vulnerable lines. Medium; OmniRoute calls npm with fixed subcommands, so request input
# does not reach npm as a glob. An overlay would cross majors outside npm's ranges.
# Accepted by the maintainer (#18765); revisit when npm ships the fixed lines (2026-12-02).
CVE-2026-118764
CVE-2026-118773