# Trivy ignore list — vulnerabilities we've consciously accepted.
#
# Each entry must include the CVE/GHSA, the package, and a reason
# we're not patching it. Re-evaluate on dependency upgrades.

# rustls-webpki 0.101.7 — DoS via panic on malformed CRL.
# Pulled in transitively by hyper-rustls 0.24, which is pinned by
# aws-smithy-http-client / aws-config. The AWS Rust SDK hasn't yet
# migrated to rustls 0.23+, so we can't bump this without forking
# the SDK. tracking/ only uses the AWS SDK for SSM + Secrets Manager
# fetched at startup over the public CA chain; the affected code
# path (CRL parsing) is not reachable in our usage.
GHSA-82j2-j2ch-gfr8

# esbuild < 0.28.1 — missing binary integrity check in the Deno module
# install path enables RCE (GHSA-gv7w-rqvm-qjhr). Pulled in transitively
# by vite / vitest / astro / tsx across admin/, docs/, site/, web/. The
# affected path is the deno.land/x/esbuild installer; we install esbuild
# only via pnpm/npm on Node, where the platform binary packages are
# integrity-pinned in the lockfile, so that path is never used. esbuild
# is a build-time dev dependency and ships in no runtime artifact.
# Re-evaluate when vite/astro bump esbuild to >= 0.28.1.
GHSA-gv7w-rqvm-qjhr

# sharp inherits libvips CVEs (GHSA-f88m-g3jw-g9cj / CVE-2026-33327, -33328,
# -35590, -35591). Fixed in sharp 0.35, and docs/ is on 0.35. The marketing
# site (site/) stays on 0.34.5 because sharp 0.35 breaks its Cloudflare Pages
# build. sharp there is build-time optimization of our own static assets with
# no untrusted input, so the practical risk is nil. Re-evaluate when the
# Cloudflare build supports sharp 0.35.
GHSA-f88m-g3jw-g9cj
CVE-2026-33327
CVE-2026-33328
CVE-2026-35590
CVE-2026-35591

# react-router 7.x — RSC-mode CSRF bypass, only fixed in 8.3.0 (the advisory
# range covers all of 7.12+). web/ and admin/ are client-side Vite SPAs using
# react-router-dom in the browser; there is no react-router server, no RSC
# mode, and no server actions, so the vulnerable path does not exist here.
# Re-evaluate when we move either app to react-router 8.
GHSA-qwww-vcr4-c8h2
