From 6f5bc6cad34e37c6f10b53f981cddf621d9b7fc8 Mon Sep 17 00:00:00 2001 From: sophia chen Date: Fri, 13 Nov 2026 10:09:20 +1100 Subject: [PATCH] UID2-8325: extend CVE-2026-40984 suppression to 2027-01-13 The micrometer-core finding is not reachable in the operator (HTTP metrics come from Vert.x, no Jetty/servlet binder), per UID2-7662. The previous suppression expired on 2026-11-11, which fails the vulnerability scan. Co-Authored-By: Claude Sonnet 5.5 --- .trivyignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index d61279cd3..614193cf8 100644 --- a/.trivyignore +++ b/.trivyignore @@ -8,7 +8,7 @@ # MicrometerMetricsOptions.setLabels(HTTP_METHOD,HTTP_CODE,HTTP_PATH,POOL_NAME) — tags computed # by Vert.x instrumentation, not Micrometer's vulnerable HTTP server binder # See: UID2-7662 -CVE-2026-40984 exp:2026-11-11 +CVE-2026-40984 exp:2027-01-13 # CVE-2026-102554 — guava (HIGH). Not vulnerable. # See: UID2-8213