# Trivy ignore list — vulnerabilities we've consciously accepted.
#
# Each entry must include the CVE/GHSA, the package, and a reason
# we're not patching it. Re-evaluate on dependency upgrades.

# rustls-webpki 0.101.7 — DoS via panic on malformed CRL.
# Pulled in transitively by hyper-rustls 0.24, which is pinned by
# aws-smithy-http-client / aws-config. The AWS Rust SDK hasn't yet
# migrated to rustls 0.23+, so we can't bump this without forking
# the SDK. tracking/ only uses the AWS SDK for SSM + Secrets Manager
# fetched at startup over the public CA chain; the affected code
# path (CRL parsing) is not reachable in our usage.
GHSA-82j2-j2ch-gfr8

# esbuild < 0.28.1 — missing binary integrity check in the Deno module
# install path enables RCE (GHSA-gv7w-rqvm-qjhr). Pulled in transitively
# by vite / vitest / astro / tsx across admin/, docs/, site/, web/. The
# affected path is the deno.land/x/esbuild installer; we install esbuild
# only via pnpm/npm on Node, where the platform binary packages are
# integrity-pinned in the lockfile, so that path is never used. esbuild
# is a build-time dev dependency and ships in no runtime artifact.
# Re-evaluate when vite/astro bump esbuild to >= 0.28.1.
GHSA-gv7w-rqvm-qjhr
