From 1846d1c7c9f9f08f5c708b11a7199c3b58978926 Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Mon, 8 Jun 2026 16:44:38 +0800
Subject: [PATCH] fix(security): add pnpm bundled dependency CVEs to
 trivyignore

All 13 HIGH CVEs (glob, minimatch, picomatch, tar) are bundled
inside pnpm 9.x itself, not in our application dependencies.
pnpm overrides only affect our app's dependency tree, not pnpm's
internal modules. All require upgrading to pnpm 10.x.
---
 .trivyignore | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index 13a34c99..6dcb3c55 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -1,6 +1,28 @@
-# pnpm 9.x CVEs -- requires major version bump to pnpm 10.x
-# These are build-time tool vulnerabilities, not runtime application code.
-# pnpm is only used for dependency installation, not user-facing functionality.
-# Tracked for upgrade: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
+# pnpm 9.x and its bundled dependencies
+# These are build-time tool internals, not runtime application code.
+# pnpm is only used for dependency installation and process management.
+# All require upgrading to pnpm 10.x (major breaking change).
+# Tracked: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
+
+# pnpm core
 CVE-2025-69262
 CVE-2025-69263
+
+# glob (bundled in pnpm 9.x, not our dependency)
+CVE-2025-64756
+
+# minimatch (bundled in pnpm 9.x)
+CVE-2026-26996
+CVE-2026-27903
+CVE-2026-27904
+
+# picomatch (bundled in pnpm 9.x)
+CVE-2026-33671
+
+# tar (bundled in pnpm 9.x)
+CVE-2026-23745
+CVE-2026-23950
+CVE-2026-24842
+CVE-2026-26960
+CVE-2026-29786
+CVE-2026-31802