fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies

- Override glob>=10.5.0 (CVE-2025-64756 command injection)
- Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS)
- Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802
  path traversal and arbitrary file overwrite)
- picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS)
- Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that
  require a major version bump to pnpm 10.x
- Restore Trivy as a blocking gate with trivyignore support
- Restore scan dependency in manifest job

.github/workflows/release.yml

@@ -277,14 +277,21 @@ jobs:
           sha=$(ls /tmp/digests | head -1)
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
 
+      - name: Checkout for trivyignore
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: .trivyignore
+          sparse-checkout-cone-mode: false
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: "ghcr.io/snapotter-hq/snapotter@sha256:${{ steps.digest.outputs.sha }}"
           format: "table"
-          exit-code: "0"
+          exit-code: "1"
           ignore-unfixed: true
           severity: "CRITICAL,HIGH"
+          trivyignores: ".trivyignore"
 
       - name: Upload results to GitHub Security
         if: always()
@@ -304,7 +311,7 @@ jobs:
 
   manifest:
     name: Create Multi-Arch Manifests
-    needs: [release, docker]
+    needs: [release, docker, scan]
     runs-on: ubuntu-latest
     permissions:
       contents: read

.trivyignore

@@ -0,0 +1,6 @@
+# pnpm 9.x CVEs -- requires major version bump to pnpm 10.x
+# These are build-time tool vulnerabilities, not runtime application code.
+# pnpm is only used for dependency installation, not user-facing functionality.
+# Tracked for upgrade: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
+CVE-2025-69262
+CVE-2025-69263

package.json

@@ -81,7 +81,10 @@
     "overrides": {
       "fast-uri": ">=3.1.2",
       "handlebars": ">=4.7.9",
+      "glob": ">=10.5.0",
+      "minimatch": ">=9.0.6",
       "picomatch": ">=4.0.4",
+      "tar": ">=7.5.11",
       "lodash": ">=4.18.0",
       "lodash-es": ">=4.18.0",
       "brace-expansion>minimatch": "^2.0.2",

pnpm-lock.yaml

@@ -7,7 +7,10 @@ settings:
 overrides:
   fast-uri: '>=3.1.2'
   handlebars: '>=4.7.9'
+  glob: '>=10.5.0'
+  minimatch: '>=9.0.6'
   picomatch: '>=4.0.4'
+  tar: '>=7.5.11'
   lodash: '>=4.18.0'
   lodash-es: '>=4.18.0'
   brace-expansion>minimatch: ^2.0.2
@@ -4856,10 +4859,6 @@ packages:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
 
-  minimatch@5.1.9:
-    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
-    engines: {node: '>=10'}
-
   minimatch@9.0.9:
     resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
     engines: {node: '>=16 || 14 >=14.17'}
@@ -11105,10 +11104,6 @@ snapshots:
     dependencies:
       brace-expansion: 5.0.6
 
-  minimatch@5.1.9:
-    dependencies:
-      brace-expansion: 2.1.1
-
   minimatch@9.0.9:
     dependencies:
       brace-expansion: 2.1.1
@@ -11720,7 +11715,7 @@ snapshots:
 
   readdir-glob@1.1.3:
     dependencies:
-      minimatch: 5.1.9
+      minimatch: 10.2.5
 
   real-require@0.2.0: {}