[IAmJSD]

Root cause

Trivy's fs scan (gomod analyzer) reports five Go advisories on current main. None of them has a version that clears it for the module path this repo resolves, so a bump can't clear them:

ID	Severity	Module	Why no bump
CVE-2026-41567	HIGH	github.com/docker/docker v28.5.1+incompatible	OSV last_affected=28.5.2; fixed only in github.com/moby/moby/v2 2.0.0-beta.14
CVE-2026-42306	HIGH	docker/docker	same
CVE-2026-41568	MEDIUM	docker/docker	same
CVE-2026-33997	MEDIUM	docker/docker	Trivy's "fixed 29.3.1" is the Docker Engine release. No docker/docker Go module v29 exists (the newest is v28.5.2+incompatible). OSV (GO-2026-4883) has no fixed event for docker/docker; the fix is in moby/moby/v2 2.0.0-beta.8
GO-2026-5932	UNKNOWN	golang.org/x/crypto (openpgp/*)	Frozen package, introduced=0, no fixed event

The sixth alert in the issue, CVE-2026-81870 in go.opentelemetry.io/otel/sdk, is already cleared on main: go.mod pins v1.45.0 (5b30fbc), and Trivy no longer reports it.

None of these is reachable:

• docker/docker: no package from this module is compiled into anything, not even a test. go list -deps ./... and go list -test -deps ./... (with and without -tags integration, in both the root and tests/e2e modules) return no github.com/docker/docker/... package. The module is only in the graph because golang-migrate's own database/pgx/v5 test imports github.com/dhui/dktest, which imports it. This repo's testcontainers usage goes through github.com/moby/moby/client. All four advisories are daemon-side (docker/docker/daemon, the plugin privilege check).
• x/crypto/openpgp: no golang.org/x/crypto/openpgp* package in either deps listing. The x/crypto packages that are actually built are bcrypt, ssh, pkcs12 and hkdf, plus their internal deps. scripts/scan-shipped-image.sh already tolerates this advisory in /app/cudly for the same reason.

Fix

Add a new .trivyignore.yaml with one entry per exact advisory ID. Each entry is scoped by purl to the module it was triaged for (pkg:golang/github.com/docker/docker or pkg:golang/golang.org/x/crypto), and has a statement and expired_at: 2027-04-20. A plain .trivyignore line matches on ID for every package. A purl-scoped entry does not, so the same CVEs are still reported for github.com/moby/moby/v2, which does have fixed versions. The file comments give the reason each advisory is unreachable, the reason there is no fix, and the review date.

The CI step "Run Trivy vulnerability scanner (filesystem)" in .github/workflows/ci.yml now reads that file through trivy-action's trivyignores: input. With a single YAML file the action exports TRIVY_IGNOREFILE pointing at it, so this step stops reading .trivyignore. That file only holds config-scan IDs, which the step's default scanners (vuln, secret) never report. .trivyignore keeps those IDs for the IaC step and the pre-commit hook, and gains a one-line pointer to the new file.

What expired_at does: after the date, Trivy stops honoring the entry and the finding comes back in the Security tab. It does not fail CI, because the fs step uses the default exit-code 0. The SARIF that step uploads carries every severity, because trivy-action unsets severity: for SARIF unless limit-severities-for-sarif is set (entrypoint.sh at the pinned v0.36.0 SHA). So the MEDIUM and UNKNOWN entries also reach the Security tab. Local make security-scan and scripts/security-scan.sh runs read the default .trivyignore, so they still list these advisories, as they do on main. Pass --ignorefile .trivyignore.yaml to get CI's vuln view locally.

CI's govulncheck source-mode step (scripts/govulncheck-retry.sh, exit 3) still fails the job if any of these vulnerable symbols becomes called. These ignores silence only the go.mod-level Trivy report.

No go.mod or go.sum change.

Verification

All of this is local scanner evidence against the trivy DB updated 2026-10-20 01:16 UTC (--skip-db-update). It is not a CI run. It was run on the tree with origin/main merged in (head 77deed6).

Trivy v0.72.0, the version CI pins: the macOS-ARM64 release tarball, checked against trivy_0.72.0_checksums.txt (OK). Commands were trivy fs -q --scanners vuln --ignorefile <file> --format json . unless noted:

repo, main's .trivyignore (no vuln entries), all severities -> 5: CVE-2026-33997 CVE-2026-41567 CVE-2026-41568 CVE-2026-42306 (docker/docker), GO-2026-5932 (x/crypto)
repo, .trivyignore.yaml                                     -> 0
CI-like: TRIVY_IGNOREFILE=.trivyignore.yaml, sarif, no severity filter, default scanners -> 0 SARIF results (base: 5)
mutation: expired_at 2026-10-20                             -> 5 again (expiry honored)
mutation: purls changed to .../dockerx and .../cryptox      -> 5 again (purl must match)

Scope probe: a scratch go.mod requiring docker/docker v28.5.1+incompatible, moby/moby/v2 v2.0.0-beta.7 and x/crypto v0.43.0:

no ignore file                  -> 28 findings, including CVE-2026-41567/42306/41568/33997 on both docker/docker and moby/moby/v2
.trivyignore.yaml (this PR)     -> 23: only the 4 docker/docker + 1 GO-2026-5932 entries are gone; all 4 CVEs still reported on moby/moby/v2
previous ID-only .trivyignore   -> 19: the moby/moby/v2 findings were hidden too (the bug the review found)
.trivyignore.yaml, purls removed -> 19 (same as ID-only)

Trivy 0.76.0 with .trivyignore.yaml on the repo: 0 findings.

Reachability:

go list -deps ./...                               | grep -E 'docker/docker|x/crypto/openpgp'   # empty
go list -test -deps ./...                         | grep -E 'docker/docker|x/crypto/openpgp'   # empty
go list -tags integration -test -deps ./...       | grep -E 'docker/docker|x/crypto/openpgp'   # empty
(cd tests/e2e && go list -tags integration -test -deps ./... | grep -E 'docker/docker|openpgp') # empty
go mod why -m github.com/docker/docker   # -> golang-migrate/.../pgx/v5.test -> dhui/dktest -> docker/docker

OSV lookups: POST https://api.osv.dev/v1/query for github.com/docker/docker@v28.5.1+incompatible, plus GET /v1/vulns/{GO-2026-4883,5617,5668,5746,5932}. The docker/docker affected entries have no fixed event; only github.com/moby/moby/v2 does. golang-migrate v4.20.0 and v4.20.1 go.mod still require github.com/docker/docker v28.5.2+incompatible.

Other checks:

• actionlint .github/workflows/ci.yml: clean. zizmor==1.29.0 --offline --persona=pedantic --min-severity=medium (the pre-commit flags): no findings.
• .trivyignore.yaml parses as YAML (5 vulnerability entries).
• Pre-commit trivy config --severity HIGH,CRITICAL --exit-code 1 ... (same args as the hook): exit 0.
• go build ./... and go vet ./... on the merged tree: ok.
• git-secrets (AWS patterns, repo .gitallowed) on the three changed files in a throwaway repo with isolated HOME: clean.
• No Go code changed, so golangci-lint, gocyclo and go test ./internal/mocks/ don't apply.

Considered and not done

• Dropping the stale github.com/docker/docker v28.5.1 requirement. go mod edit -droprequire followed by go mod tidy leaves go.mod without it, and Trivy would stop reporting. But the graph would then silently select the older v28.3.3 from golang-migrate, and the module would still be present. That hides the finding from the scanner without changing exposure, so I kept the explicit, dated ignore.
• Bumping docker/docker to v28.5.2 or golang-migrate to v4.20.1. Both are still affected (last_affected=28.5.2), so this is churn with no effect on these alerts.
• GO-2026-4887 / CVE-2026-34040 (docker/docker AuthZ plugin bypass, also daemon-side and unfixed on this path): Trivy doesn't report it today, so it gets no ignore entry.

Closes #3

Maintainer: please mirror the issue's triage labels onto this PR: priority/p2, severity/medium, impact/internal, triaged, urgency/this-quarter, effort/s, type/security.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 3 billable files and costs up to $0.75.}

Or wait 9 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 8f186a8
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 755a044c-9550-4e1e-9b1d-c6e52b58f080

Commits

Reviewing files that changed from the base of the PR and between 8f186a8 and e6c1964.

Files selected for processing: 3

• .github/workflows/ci.yml
• .trivyignore
• .trivyignore.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review 2 (claude-fleet, cold): APPROVE 7bf37f4

Findings (none blocking):

• [non-blocking] .trivyignore:144-147,162 - Each entry matches on the advisory ID alone, so it hides that ID for every package Trivy finds it in, not just github.com/docker/docker or x/crypto/openpgp.
  • Issue sec(deps): clear Trivy alerts inherited from the monorepo (docker, otel/sdk, x/crypto openpgp) #3 asked for a "scoped" entry.
  • Failure scenario: CVE-2026-33997 arrives later through another package and stays hidden until 2027-04-20.
  • Scoping by purl would mean switching to .trivyignore.yaml and adding a trivyignores input to both trivy-action steps in ci.yml.
  • The exposure is limited, because govulncheck still gates reachable calls and the entries expire.
• [non-blocking] PR body, Verification - The body cites Trivy v0.72.0, the version CI pins. I could only run v0.76.0 against a cached DB, so I have not confirmed the v0.72.0 result myself. The exp: syntax long predates both versions.
• No finding: the Trivy fs step in ci.yml (~:813) uses exit-code 0, so this PR clears Security tab alerts and gates nothing. That matches the issue's acceptance criteria.

Root cause:

• The base scan reports exactly the 5 IDs the PR names.
• otel/sdk is already v1.45.0 (go.mod:171), so the issue's sixth alert is already gone.
• golang-migrate is at v4.19.1. The body's "v4.20.x still requires docker v28.5.2" is about the bump option, not the current pin.
• Nothing builds docker/docker or openpgp:
  • go list -deps, -test -deps and -tags integration -test -deps (root and tests/e2e) all return 0 hits.
  • go mod why shows the path migrations -> golang-migrate pgx/v5.test -> dhui/dktest -> docker/docker.

Attacked:

• Drift: merge-tree --write-tree origin/main <head> is clean.
  • .trivyignore and the docker/x/crypto requirements are unchanged on main.
  • go.mod differs by one // indirect marker, and ci.yml adds two non-Trivy terraform steps.
  • Every scan was re-run on a merged-tree export.
• Probes:
  • exp set to 2026-10-19: all 5 findings return, so expiry is enforced.
  • The GO-2026-5932 line removed: that finding returns.
  • CVE-2026-41567 mistyped as 41576: that finding returns, so IDs are exact-matched.
  • A malformed date (exp:2027/04/20): all 5 return. A bad date makes the entry not apply rather than silencing forever, so it fails loudly.
  • Extra whitespace around the exp token: still suppressed.
• Other checks:
  • scripts/scan-shipped-image.sh uses govulncheck binary mode, not .trivyignore, so it is unaffected.
  • The pre-commit trivy-config hook passes with the new file.
• Fail-before: the PR has no tests. The base vs head scans below are the evidence.

Verified locally, with no cloud credentials, under the heavy lock, using --skip-db-update:

• trivy fs -q --scanners vuln --format json .:
  • Base, all severities: 5 findings (CVE-2026-33997 medium, CVE-2026-41567 high, CVE-2026-41568 medium, CVE-2026-42306 high, GO-2026-5932 unknown).
  • Base, CRITICAL,HIGH: 2.
  • Head and the merged tree: 0 at every severity.
• CI-exact run (default ignorefile, sarif, CRITICAL,HIGH): 2 results on base, 0 on the merged tree.
• trivy config --severity HIGH,CRITICAL --exit-code 1 (the pre-commit hook's arguments) on head: rc 0.
• govulncheck ./...:
  • Root: rc 0. GO-2026-5932 appears only as "in modules you require, but your code doesn't appear to call". The docker advisories do not appear, because docker/docker is not in the build list.
  • tests/e2e: rc 0, "No vulnerabilities found."
• Merged tree: go build ./... ok.
• No Go code changed and no migration.

Reviewed by an independent agent with no author context (second reviewer). Review only: nothing was pushed, and the GitHub review state is unchanged.

[cristim]

VERDICT: REQUEST_CHANGES 7bf37f4

PR #1193 (closes #3), reviewed at head 7bf37f4. Base origin/main 7eac792; git merge-tree is clean (tree 01c314a0). One commit, 51 changed lines, under the 400 cap.

Findings

• medium .trivyignore:146-149,162 - The ignores match on advisory ID only, so they apply to every package in every scan. Issue sec(deps): clear Trivy alerts inherited from the monorepo (docker, otel/sdk, x/crypto openpgp) #3's Fix section asks for a "scoped .trivyignore entry". The same IDs (GO-2026-5746/5617/5668/4883) also cover github.com/moby/moby/v2, which has fixed versions (2.0.0-beta.8 and beta.14). Failure scenario: someone adopts moby/moby/v2 below beta.14, which is the migration this comment says to watch for. Trivy then silently suppresses CVE-2026-41567/42306/41568/33997 for a package where a fix exists. Reproduced: a scratch go.mod that requires moby/moby/v2 v2.0.0-beta.7 reports 5 advisories without the ignore file and only CVE-2026-34040 with this one. Fix: move these five entries to a .trivyignore.yaml with purls: (e.g. pkg:golang/github.com/docker/docker, pkg:golang/golang.org/x/crypto), statement: and expired_at:, and point the fs step at it (trivyignores: input).
• nit .trivyignore:117-119 - "the finding reappears, forcing a re-check" holds only for the Security tab. The CI Trivy fs step uses the default exit-code 0 (ci.yml:813-835), so CI stays green after expiry. The three MEDIUM/UNKNOWN entries are also never reported by CI because of severity: CRITICAL,HIGH. They matter only to local make/security-scan.sh runs. Say this in the comment and PR body ("the review date is enforced").

Confirmed correct

• None of the five advisories has a fix on the paths this repo resolves. OSV GO-2026-5746/5617/5668 list docker/docker as introduced=0 with no fix, and the GHSA aliases say last_affected=28.5.2. GO-2026-4883 has no docker/docker fix. GO-2026-5932 is introduced=0. proxy.golang.org lists docker/docker up to v28.5.2+incompatible, and golang-migrate @latest is v4.20.1.
• Unreachable: on the merged tree, go list -deps, -test -deps and -tags integration -test -deps ./... return no docker/docker or x/crypto/openpgp package.

Attacked

• trivy 0.76 fs on the merged tree: main's ignore file gives 5 findings (2 HIGH), the PR's gives 0.
• Mutation: exp set to 2026-10-20, all 5 reappear (expiry honored).
• Scope probe (moby/moby/v2 beta.7) as above.
• actionlint .github/workflows/*.yml: clean. trivy config with the pre-commit hook args on the merged tree: exit 0.
• Not run: scripts/test-git-secrets-allowlist.sh (it needs a git checkout; the scratch export has none). No workflow or code change.

[IAmJSD]

Thanks for both reviews. Addressed at head 77deed6. main is merged in (aabe2c0, no conflicts). It's a merge, not a rebase.

VERDICT review (REQUEST_CHANGES at 7bf37f4)

• medium: ignores are ID-only, not scoped. Fixed. The five entries moved out of .trivyignore into a new .trivyignore.yaml (lines 54-90). Each has purls: (pkg:golang/github.com/docker/docker or pkg:golang/golang.org/x/crypto), a statement: and expired_at: 2027-04-20. .trivyignore keeps only the config IDs plus a pointer (.trivyignore:113-115). The CI fs step sets trivyignores: '.trivyignore.yaml' (.github/workflows/ci.yml:829-834). At the pinned trivy-action SHA, a single YAML file is exported as TRIVY_IGNOREFILE, so this step no longer reads the plain file. It doesn't need to, because its default scanners (vuln, secret) never report config IDs. I reproduced your probe with Trivy v0.72.0, using a scratch go.mod with docker/docker v28.5.1, moby/moby/v2 v2.0.0-beta.7 and x/crypto v0.43.0:
  • no ignores: 28 findings
  • old ID-only file: 19 (the moby/moby/v2 CVEs were hidden)
  • new YAML: 23. Only the 4 docker/docker findings and GO-2026-5932 are removed. CVE-2026-41567/42306/41568/33997 are still reported on moby/moby/v2.
  • YAML with the purls removed: 19 again, so the scoping is what keeps moby reported.
• nit: expiry wording. Fixed in .trivyignore.yaml:12-25, and the PR body no longer says "the review date is enforced". It now says that after expired_at the finding returns in the Security tab but CI stays green, because the fs step uses exit-code 0. One correction to the premise: the MEDIUM/UNKNOWN entries do reach CI's SARIF. trivy-action v0.36.0's entrypoint.sh (lines 76-83) runs unset TRIVY_SEVERITY for format: sarif unless limit-severities-for-sarif is set. So severity: CRITICAL,HIGH doesn't filter the uploaded SARIF. A CI-like run (sarif, no severity filter) gives 5 results on base. Local make security-scan / security-scan.sh read the default .trivyignore, so they still list these advisories, as on main. The file comment says how to match CI locally.

Independent review 2 (APPROVE at 7bf37f4)

• non-blocking: ID-only scope. Same fix as above.
• non-blocking: v0.72.0 result unconfirmed. I re-ran everything on the merged tree with v0.72.0 (release tarball, checksum OK against trivy_0.72.0_checksums.txt, DB 2026-10-20). Results: repo with main's .trivyignore gives 5, with .trivyignore.yaml gives 0, and the CI-like SARIF run gives 0. Setting expired_at to 2026-10-20 brings back 5, and so do wrong purls. Trivy 0.76.0 also gives 0.

Other checks on 77deed6: actionlint on ci.yml is clean. zizmor 1.29.0 with the pre-commit flags finds nothing. .trivyignore.yaml parses. The pre-commit trivy config hook args return rc 0. go build ./... and go vet ./... are ok. git-secrets (AWS patterns + .gitallowed) in a throwaway repo with isolated HOME is clean. No Go code changed. PR body updated (Fix and Verification sections). PR stays a draft.

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 77deed6271645417504e470c07dea4baa378395d

Blocking:

• none

Non-blocking:

• There are now two ignore files with split readers. CI's fs step reads .trivyignore.yaml; make security-scan, scripts/security-scan.sh and pre-commit read .trivyignore. Trivy's YAML format also has a misconfigurations: section, so moving the config IDs there and pointing every reader at the one YAML file would make local and CI agree. The PR documents the split, so this is a nice-to-have.
• When the ignores expire on 2027-04-20, the findings only reappear in the Security tab; CI doesn't fail (exit-code 0, as the file says). If nobody watches the tab, the review date can pass unnoticed. A tracking issue or reminder for the review date would help.

Attacked:

• Ignore-file plumbing: I read trivy-action's entrypoint.sh and action.yaml at the pinned ed142fd0 SHA.
  • A single *.yaml in trivyignores takes the YAML path and export TRIVY_IGNOREFILE=<file> inside the entrypoint process only. Only trivy_envs.txt crosses steps, and the action deletes it with always(), so the later IaC trivy config step (exit-code 1) can't inherit the YAML file and lose its .trivyignore config IDs.
  • SARIF does unset TRIVY_SEVERITY, as the body says.
• Scanner evidence with the CI-pinned Trivy v0.72.0 (Linux release, sha256 checked against the release checksums) and today's DB:
  • trivy fs --scanners vuln with .trivyignore gives exactly the 5 findings (4 x docker/docker v28.5.1, GO-2026-5932 on x/crypto v0.57.0);
  • with .trivyignore.yaml it gives 0;
  • with the docker purls retargeted to moby/moby/v2 the 4 docker CVEs come back, so purl scoping is real;
  • a CI-like SARIF run with default scanners and no severity filter gives 0 results.
• Reachability: go list -test -deps ./..., with and without -tags integration, plus tests/e2e with -tags e2e: 0 docker/docker or x/crypto/openpgp packages. go mod why -m github.com/docker/docker goes through golang-migrate's pgx/v5 test -> dhui/dktest, as claimed.
• Acceptance of sec(deps): clear Trivy alerts inherited from the monorepo (docker, otel/sdk, x/crypto openpgp) #3: every remaining alert has a justified, dated, purl-scoped ignore. otel/sdk is already at a fixed version on main. Closes sec(deps): clear Trivy alerts inherited from the monorepo (docker, otel/sdk, x/crypto openpgp) #3 is right.

Body-stale:

• none

_{Reviewer: rA2. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[cristim]

VERDICT: APPROVE e6c1964

Findings: no blocking findings.

• nit .trivyignore.yaml:1 - local make security-scan (Makefile:170) and scripts/security-scan.sh:68 still read the plain .trivyignore, so local runs keep listing these five advisories. Documented in the file header and unchanged from main, so not a regression.

Issue #3 check: all six alerts are handled. otel/sdk is already v1.45.0 on main (go.mod:171), so CVE-2026-81870 needs nothing. The four docker/docker CVEs and GO-2026-5932 get purl-scoped, dated (2027-04-20) entries with written reasons, which meets the issue's acceptance ("every remaining alert has a justified, dated ignore entry"). The issue text said docker comes in through testcontainers; the PR's correction (golang-migrate pgx/v5 test -> dhui/dktest) is right: go mod why -m github.com/docker/docker shows exactly that chain.

Attacked:

• Clean merge onto origin/main 8f186a8: git merge-tree --write-tree origin/main e6c19648 clean (tree f6edafd5). Checks below ran on that merged tree.
• trivy-action behaviour, checked in the pinned source (ed142fd0, entrypoint.sh:22-71): a single YAML trivyignores file exports TRIVY_IGNOREFILE= and the plain .trivyignore is not read; mixing YAML and plain files is an error, so the single-file choice is required. entrypoint.sh:76-79 unsets TRIVY_SEVERITY for SARIF unless limit-severities-for-sarif is true, so MEDIUM/UNKNOWN entries matter for the Security tab, as the comment says.
• Dropping .trivyignore from the fs step loses nothing: every entry in it is a config ID (8 AVD-AWS, 2 AVD-AZU, 2 AZU, 2 GCP), and the fs step's default scanners are vuln and secret. TRIVY_IGNOREFILE=.trivyignore.yaml trivy fs --format sarif . (default scanners) returns 0 results.
• Local trivy 0.76.0, DB 2026-10-19, trivy fs --scanners vuln: with .trivyignore, 5 findings (CVE-2026-33997/41567/41568/42306 on docker/docker v28.5.1, GO-2026-5932 on x/crypto v0.57.0); with .trivyignore.yaml, 0.
• Mutation probes on .trivyignore.yaml (restored, cmp-verified):
  1. docker purl changed to .../dockerx: 4 findings return (purl scoping is live).
  2. expired_at set to 2026-10-01: 5 findings return (expiry honoured).
  3. GO-2026-5932 id changed: GO-2026-5932 returns (entry matches by exact ID).
• Reachability: go list -test -deps ./... with and without -tags integration, and the tests/e2e module with -tags integration, contain no docker/docker or x/crypto/openpgp package (count 0 each).
• Defence-in-depth claims: govulncheck runs in source mode per module through scripts/govulncheck-retry.sh (ci.yml:1106); scripts/scan-shipped-image.sh:30 already tolerates GO-2026-5932.
• Scope: 3 files, +100/-0, no Go, go.mod or go.sum change. No secrets, account IDs or internal paths in the added text.
• CI on e6c1964: 35 pass, 1 skipping.

[IAmJSD]

Local verification at e6c196489293f29eb6a0a4be2d99d96aa281eb97 merged onto main (26004a6d), together with #974, #1106, #1151, #1193, #1199, #1212, #1217, #1218, #1219, #1221, #1223, #1224, #1225, #1226, #1227, #1256, #1262, #1266, #1272, #1275, #1283, #1286, #1293, #1299, #1300, #1313 in that order (combined tree d3d95c83, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on e6c19648 (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly e6c196489293f29eb6a0a4be2d99d96aa281eb97.