.trivyignore

# Trivy ignore file
# Add CVE IDs or secret rule IDs here to suppress specific findings.
#
# Format:
#   CVE-2024-12345                     # Suppress a specific CVE
#   generic-api-key:path/to/file.txt   # Suppress a secret finding in a specific file
#
# Note: launcher/, console/, and docs/site/api/ are git-crypt encrypted.
# In CI, the security-scan job decrypts them before scanning.
# The pre-commit hook skips launcher/ and docs/site/api/ via skip-dirs.
#
# See: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/

# minimatch ReDoS — transitive dev dependency of @typescript-eslint/typescript-estree.
# Fix (10.2.1) requires major version bump that @typescript-eslint hasn't adopted yet.
CVE-2026-26996

# brace-expansion DoS - transitive build-time dependency of the docs sites,
# pinned three levels down: @docusaurus/core -> serve-handler -> minimatch@3.x
# -> brace-expansion@1.1.16. Fix (5.0.8) is a major bump that minimatch@3 cannot
# take, so it is unreachable until Docusaurus moves off serve-handler. Not
# shipped to users: Docusaurus emits static HTML and this only runs during the
# local `npm run serve` preview.
CVE-2026-14257