Skip to content

UID2-8316, UID2-8317, UID2-8318: suppress 3 CVEs in .trivyignore #1097

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samin-ttd merged 1 commit into from
Nov 11, 2026
Merged

UID2-8316, UID2-8317, UID2-8318: suppress 3 CVEs in .trivyignore #1097

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 11 additions & 24 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,30 +17,17 @@ CVE-2026-18446 exp:2026-11-06
# See: UID2-7619
CVE-2026-69152 exp:2026-11-06

# CVE-2025-71329 — image-size (npm, transitive via @docusaurus/mdx-loader) (HIGH).
# Not exploitable here: package-lock.json:9929 pins image-size@2.0.2, pulled in only as a
# transitive dep of @docusaurus/mdx-loader (line 3433); not a direct dependency in
# package.json. Used at build time by `npm run build` (deploy.yml) to size images in markdown;
# output is a static site deployed to GitHub Pages (no Node runtime/event loop in prod). No
# .jxl/.heif/.heic assets exist and no src code calls image-size directly.
# See: UID2-7653
CVE-2025-71329 exp:2026-11-11

# CVE-2025-71330 — image-size (npm, transitive via @docusaurus/mdx-loader) (HIGH).
# Not exploitable here: package-lock.json:9929 pins image-size@2.0.2; declared only as a
# dependency of @docusaurus/mdx-loader (package-lock.json:3433), not in package.json. Project
# is a Docusaurus static site (package.json build script 'docusaurus build');
# .github/workflows/deploy.yml runs npm ci + npm run build and uploads ./build to GitHub Pages
# — no runtime Node service. No direct image-size import in src/ and no committed .icns files.
# See: UID2-7654
CVE-2025-71330 exp:2026-11-11

# CVE-2026-67213 — nanoid (transitive via postcss) (HIGH).
# Not exploitable here: nanoid 3.3.16 present once, transitively via postcss@8.5.18
# (overridden). Docusaurus static-site build tooling; no nanoid import or
# customAlphabet/customRandom call in any source file. Vulnerable path never invoked.
# See: UID2-7658
CVE-2026-67213 exp:2026-11-11
# CVE-2025-71329 — image-size (HIGH). Not vulnerable.
# See: UID2-8316
CVE-2025-71329

# CVE-2025-71330 — image-size (HIGH). Not vulnerable.
# See: UID2-8317
CVE-2025-71330

# CVE-2026-67213 — nanoid (HIGH). Not vulnerable.
# See: UID2-8318
CVE-2026-67213

# GHSA-5p4m-2wfm-xmqj — js-yaml (3.15.0 and 4.3.0, transitive npm dependency) (HIGH).
# Not exploitable here: Docusaurus SSG; js-yaml reaches build via gray-matter (3.15.0) and
Expand Down
Loading