From aea1a575d62620d3c33d79aa5bd9d55ed6364a51 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 6 Aug 2026 15:53:56 +1000 Subject: [PATCH 1/2] UID2-7633, UID2-7619: suppress 2 CVEs in .trivyignore (exp 2026-09-06) - CVE-2026-18446 (UID2-7633) - CVE-2026-69152 (UID2-7619) Each is present but not reachable from this service; see the linked tickets for the per-CVE impact assessments. Reachability alone determines suppress-vs-fix. --- .trivyignore | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.trivyignore b/.trivyignore index 3aa85f54a..3dd0956db 100644 --- a/.trivyignore +++ b/.trivyignore @@ -3,3 +3,16 @@ # for more details # e.g. # CVE-2022-3996 + +# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH). +# Not exploitable here: fast-uri 3.1.4 transitive via ajv (package-lock:5831), override at +# package.json:71; zero require/import of fast-uri; build-time schema validation only +# See: UID2-7633 +CVE-2026-18446 exp:2026-09-06 + +# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH). +# Not exploitable here: package-lock.json:6291 brace-expansion@5.0.8 pulled only by +# minimatch@10.2.4 (dependencies: brace-expansion ^5.0.2); Docusaurus build/lint tooling; no +# brace-expansion/minimatch/glob import in src/ +# See: UID2-7619 +CVE-2026-69152 exp:2026-09-06 From ed0d8a121570bf85f14eaae7e00486deefd5f418 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 6 Aug 2026 16:06:38 +1000 Subject: [PATCH 2/2] extend suppression window to 3 months (exp 2026-11-06) --- .trivyignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.trivyignore b/.trivyignore index 3dd0956db..17255f26b 100644 --- a/.trivyignore +++ b/.trivyignore @@ -8,11 +8,11 @@ # Not exploitable here: fast-uri 3.1.4 transitive via ajv (package-lock:5831), override at # package.json:71; zero require/import of fast-uri; build-time schema validation only # See: UID2-7633 -CVE-2026-18446 exp:2026-09-06 +CVE-2026-18446 exp:2026-11-06 # CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH). # Not exploitable here: package-lock.json:6291 brace-expansion@5.0.8 pulled only by # minimatch@10.2.4 (dependencies: brace-expansion ^5.0.2); Docusaurus build/lint tooling; no # brace-expansion/minimatch/glob import in src/ # See: UID2-7619 -CVE-2026-69152 exp:2026-09-06 +CVE-2026-69152 exp:2026-11-06