External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(trivy): ignore npm-bundled sigstore CVE-2026-48815 (build-tool internal, not runtime-reachable) [skip ci]

Browse Source
This commit is contained in:
SnapOtter
2026-07-07 16:08:13 +08:00
parent 88a611d28b
commit 531ecca9c2
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.trivyignore
+8
View File
@@ -48,3 +48,11 @@ CVE-2026-33809
# pulled by glob, whose fix is a major-version bump (5.0.5) the glob ecosystem
# has not adopted. Not reachable from user input.
CVE-2026-33750
# npm bundled sigstore (build-time tool internal, not runtime-reachable).
# CVE-2026-48815: sigstore certificateOIDs verification constraints silently dropped.
# This is the npm CLI vendored copy (node_modules/npm/node_modules/sigstore), used
# only for npm package provenance at build time; SnapOtter never runs npm provenance
# verification at runtime. Same build-tool rationale as the pnpm entries above.
# Re-evaluate when the Node base image ships a fixed npm.
CVE-2026-48815