# Trivy ignore list
#
# Every entry in this file is a known HIGH or CRITICAL CVE that we have
# consciously accepted risk on and decided not to block CI over. Format:
#
#   CVE-YYYY-NNNNN
#   # Justification: why we're accepting this risk, and a link or note about
#   # when to revisit (e.g. "blocked on upstream base image update, revisit
#   # when alpine/node:22 ships a fix").
#
# Rules:
#   - Every CVE MUST have a justification comment directly above it.
#   - If there is no justification, the CVE is not ignored - add it here only
#     after a human review and a decision to accept the risk.
#   - Review this file on every release; remove entries whose upstream fix has
#     landed.
#
# Picked up automatically by aquasecurity/trivy-action from the repo root
# working directory. Both the pre-push PR scan (.github/workflows/ci.yml) and
# the release-time re-scan (.github/workflows/docker-publish.yml) honor it.

# ---------------------------------------------------------------------------
# Bundled inside /usr/local/bin/docker and docker-compose
# ---------------------------------------------------------------------------
# Docker CLI 29.4.0 ships Go 1.26.1 and Compose v5.1.2 ships Go 1.25.8.
# Both Go versions are vulnerable (fix requires Go 1.25.9 or 1.26.2).
# No upstream static binary ships a patched Go runtime yet. Revisit on the
# next Docker CLI and Compose release.

# Justification: Go stdlib symlink-following in Root.Chmod. Sencho does not
# use Root.Chmod; the Docker CLI and compose plugin are invoked as
# subprocesses to manage containers. The vulnerable code path requires a
# chroot context with attacker-controlled filesystem, which does not apply
# to our usage. Blocked on upstream Go rebuild; revisit on next CLI/Compose
# release.
CVE-2026-32282

# Justification: Go stdlib crypto/x509 certificate chain building DoS via
# crafted certificate. Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose)
# runtimes. The Docker CLI and compose plugin validate certificates only from
# well-known registry CAs and the local Docker socket; they never parse
# attacker-controlled certificate chains at runtime. Blocked on upstream Go
# rebuild; revisit on next CLI/Compose release.
CVE-2026-32281

# Justification: Go stdlib TLS stack exhaustion via repeated KeyUpdate messages
# from a peer. Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes.
# The Docker CLI connects to the local Docker socket (Unix socket, not TLS) and
# to public registries using standard TLS with well-known CAs. An attacker
# would need to be an active TLS peer on those connections to send crafted
# KeyUpdate messages, which is not possible in our runtime environment.
# Blocked on upstream Go rebuild; revisit on next CLI/Compose release.
CVE-2026-32283

# Justification: Go stdlib crypto/x509 certificate chain building DoS.
# Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes as above.
# The Docker CLI and compose plugin do not perform x509 chain validation
# against untrusted certificates in our usage (they connect to the local
# Docker socket or to registries with well-known CAs). Blocked on upstream
# Go rebuild; revisit on next CLI/Compose release.
CVE-2026-32280

# Justification: Go stdlib crypto/x509 certificate validation bypass due to
# incorrect DNS name constraint handling. Fixed in Go 1.26.2, but Docker CLI
# 29.4.0 ships Go 1.26.1 and no newer upstream static binary is available.
# Same exposure profile as CVE-2026-32280: the Docker CLI and compose plugin
# only validate certificates from well-known registry CAs and the local
# Docker socket in our usage, not from attacker-controlled CAs with crafted
# DNS name constraints. Blocked on upstream Go rebuild; revisit on next
# CLI/Compose release.
CVE-2026-33810

# ---------------------------------------------------------------------------
# Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2)
# ---------------------------------------------------------------------------
# Compose v5.1.2 is the latest upstream release. It statically links older
# copies of github.com/docker/docker, buildkit, and otel. We cannot bump
# these transitively without waiting for a new upstream Compose release.
# Revisit this block on every Compose release; remove entries as upstream
# rebuilds ship the fixes.

# Justification: github.com/docker/docker v28.5.2 statically bundled in
# compose v5.1.2. Moby authz bypass applies to a Docker daemon, not to the
# compose CLI plugin; compose never runs as a daemon. Revisit on next
# Compose upstream release.
CVE-2026-34040

# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
# compose v5.1.2. BuildKit arbitrary file write via untrusted frontend is
# exploited at buildkit build time with attacker-controlled frontends; our
# compose invocations only call up/down/ps against local user-authored
# compose files, never as a build frontend. Revisit on next Compose upstream
# release.
CVE-2026-33747

# Justification: github.com/moby/buildkit v0.27.1 statically bundled in
# compose v5.1.2. Same exposure profile as CVE-2026-33747 (Git URL fragment
# subdir exploitation requires invoking buildkit on untrusted repo URLs,
# which compose does not do in our flow). Revisit on next Compose upstream
# release.
CVE-2026-33748

# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
# compose v5.1.2. PATH hijacking requires the attacker to control the
# process PATH before compose starts; our container starts compose from a
# fixed PATH with only /usr/local/bin and /usr/bin on it, both owned by
# root. Revisit on next Compose upstream release.
CVE-2026-24051

# Justification: go.opentelemetry.io/otel/sdk v1.38.0 statically bundled in
# compose v5.1.2. BSD kenv PATH hijacking only applies on BSD systems; we
# ship linux/amd64 and linux/arm64. Not applicable in our runtime. Revisit
# on next Compose upstream release.
CVE-2026-39883

# Justification: google.golang.org/grpc v1.78.0 statically bundled in
# Docker CLI v29.4.0. Compose v5.1.2 bumped grpc to 1.80.0, resolving this
# for the compose binary. The CLI still ships 1.78.0. Exploit requires an
# attacker-controlled HTTP/2 peer talking to a gRPC server; the docker CLI
# only acts as a gRPC client against the local unix socket, not as a server.
# Revisit on next Docker CLI release.
CVE-2026-33186

# ---------------------------------------------------------------------------
# Bundled inside /usr/local/lib/node_modules/npm/ (node:22-alpine base image)
# ---------------------------------------------------------------------------

# Justification: picomatch 4.0.3 is shipped inside the npm CLI that comes
# bundled with the upstream node:22-alpine base image. We do not run npm at
# container runtime against user-controlled input; npm is only invoked at
# build time against our own package.json files. The ReDoS requires an
# attacker-authored extglob pattern, which is not reachable from any
# runtime code path. Revisit when a future node:22-alpine base image ships
# a newer npm that bundles picomatch >= 4.0.4.
CVE-2026-33671