.grype.yaml

# BQC-7.7 — grype ignore rules for the container scanning gate (ci.yml
# `docker` job, anchore/scan-action with fail-build: true,
# severity-cutoff: high; policy: docs/operations/security-ci-policy.md).
#
# Zero exceptions is the target. Before any entry below is written, every
# finding WITH a fix is fixed: the base is node:22.23.4-trixie-slim (Debian 13,
# plan revision R2, 2026-09-07; bookworm was EOL), the npm CLI is stripped from
# every runtime stage, and OpenSSL is pinned to the patched 3.5.7-1~deb13u3 in
# every Dockerfile base stage (nine CVEs incl. CVE-2026-63073 / CVE-2026-75803
# Critical — the only fixable class trixie shipped with — plus DSA-6531-1's
# thirteen, 2026-09-30, incl. CVE-2026-72897 / -84782 / -84784 High). What
# remains is marked won't-fix / not-fixed by Debian for trixie as well; the
# base swap did not clear these, it only moved their package versions. Every
# entry carries owner/reason/expiresAt and is re-justified at the quarterly
# review and on every base-image bump. grype has no native expiry, so the
# dates are enforced by `pnpm check:container-images`
# (scripts/ci/grype-exception-expiry.ts): each rule takes the one
# `expiresAt: YYYY-MM-DD` in the comment block directly above it — no blank
# line between — and the gate fails the day after that date, or when a rule
# has no such date. The gate reads lines while grype reads YAML, so keep the
# one shape below: this plain `ignore:` key, then one `- ` item per rule on
# its own line. A flow list, an alias, a quoted key or a line that belongs to
# no rule fails the gate. A new entry needs the finding named (package, CVE,
# grype's own identity line).

ignore:
  # ── Debian trixie base packages, perl-base 5.40.1-6 (13 CVEs) ─────────
  # owner: platform — reason: Debian marks these won't-fix/not-fixed for
  # trixie (tracker read 2026-09-07 from the CI scan of the trixie image);
  # perl-base is dpkg infrastructure only — the CMD is node and nothing in the
  # image executes perl. expiresAt: 2026-12-07
  - vulnerability: CVE-2026-12087 # not-fixed
  - vulnerability: CVE-2026-13221 # not-fixed
  - vulnerability: CVE-2026-42496 # wont-fix
  - vulnerability: CVE-2026-42497 # wont-fix
  - vulnerability: CVE-2026-48959 # not-fixed
  - vulnerability: CVE-2026-48961 # not-fixed (new in the trixie scan)
  - vulnerability: CVE-2026-48962 # not-fixed
  - vulnerability: CVE-2026-57432 # not-fixed
  - vulnerability: CVE-2026-57433 # not-fixed
  - vulnerability: CVE-2026-7017 # not-fixed
  - vulnerability: CVE-2026-8376 # wont-fix
  - vulnerability: CVE-2026-9538 # wont-fix
  # CVE-2026-82560 (added 2026-09-22, first reported by the grype DB built
  # that morning): `perl-base` 5.40.1-6 deb CVE-2026-82560 High, no fixed
  # version. Pod::Text loops without consuming input on deeply nested `=over`
  # blocks, exhausting CPU and memory while formatting POD. The Debian tracker
  # (read 2026-09-22) lists bookworm, trixie and forky/sid all vulnerable; the
  # fix exists only upstream (podlators 6.1.1). Nothing in the image formats
  # POD or runs perl: the CMD is node. Drop this entry at the first trixie
  # perl update that carries the podlators fix. expiresAt: 2026-12-07
  - vulnerability: CVE-2026-82560 # not-fixed (all Debian releases)

  # ── Debian trixie base packages, glibc 2.41-12+deb13u3 (4 CVEs) ────────
  # owner: platform — reason: won't-fix by Debian triage (assessed not
  # exploitable in practice); no patched trixie package exists.
  # CVE-2026-19499 (added 2026-09-15, first reported by the grype DB built
  # that morning): `libc-bin`/`libc6` 2.41-12+deb13u3 (won't fix) deb
  # CVE-2026-19499 High. An out-of-bounds write in `strfmon`/`strfmon_l` when a
  # conversion uses right-justified width padding (glibc 2.38–2.44). The
  # Debian tracker (read 2026-09-15) marks it a minor issue, no-dsa for trixie
  # and postponed for bookworm; only sid/forky carry the fix (2.43-5). Nothing
  # in the image calls strfmon: the CMD is node, which formats money and
  # numbers through its bundled ICU (`Intl`), not the C locale's monetary
  # functions. Drop this entry at the first trixie glibc update that fixes it.
  # expiresAt: 2026-12-07
  - vulnerability: CVE-2026-5450 # wont-fix (critical per NVD, wont-fix per Debian)
  - vulnerability: CVE-2026-5435 # wont-fix
  - vulnerability: CVE-2026-5928 # wont-fix
  - vulnerability: CVE-2026-19499 # strfmon overflow, no-dsa minor issue on trixie

  # ── glibc 2.41-12+deb13u4 gettext LANGUAGE paths: no fix anywhere (1 CVE) ─
  # owner: platform — reason: CVE-2026-84243 (added 2026-10-31, first reported
  # by the grype DB the PR #1046 scan used): `libc-bin`/`libc6`
  # 2.41-12+deb13u4 deb CVE-2026-84243 High, no fixed version. The gettext
  # family accepts LANGUAGE entries containing "/" or "..", so whoever controls
  # LANGUAGE can make a program load a message catalog from any path, and a
  # crafted .mo file can crash it or run code; it also needs another installed
  # locale selected through LANG or LC_ALL (GLIBC-SA-2026-0025). The Debian
  # tracker (read 2026-10-31) lists bookworm, trixie, forky and sid all
  # vulnerable and unfixed (bug 1152640), so there is nothing to pin. In the
  # images nobody but the deployment sets the environment, no locale beyond the
  # slim base's C locale is installed, and the CMD is node, which takes its
  # messages from its bundled ICU, not gettext. Drop this entry at the first
  # trixie glibc update that fixes it. expiresAt: 2026-11-30
  - vulnerability: CVE-2026-84243 # gettext LANGUAGE path traversal, unfixed in every Debian release

  # ── libgcc-s1 / libstdc++6 / gcc-14-base 14.2.0-19: no fix yet (1 CVE) ─
  # owner: platform — reason: CVE-2026-102010 (High) appeared in grype's
  # database 2026-10-01 against the gcc-14 runtime libraries with no fixed
  # version on trixie. Nothing to pin. The images run node, which links
  # libstdc++/libgcc_s as runtime support only; there is no compiler in the
  # image and the CVE is matched by package, not by a reachable code path
  # from the app. Drop this entry at the first trixie gcc-14 update that
  # fixes it. Extended 2026-10-01: the Debian tracker lists every release
  # vulnerable with no fixed package, and apt in the pinned base offers only
  # 14.2.0-19. expiresAt: 2026-11-15
  - vulnerability: CVE-2026-102010

  # ── libgcc-s1 / libstdc++6 / gcc-14-base 14.2.0-19: second unfixed CVE ──
  # owner: platform — reason: CVE-2026-95619 (High) appeared in grype's
  # database 2026-10-03 against the same gcc-14 runtime libraries, with no
  # fixed version on trixie (grype: `gcc-14-base` / `libgcc-s1` /
  # `libstdc++6` 14.2.0-19 deb CVE-2026-95619 High, no fixed version).
  # Nothing to pin. Same exposure as CVE-2026-102010 above: node links
  # libstdc++/libgcc_s as runtime support only and the image has no
  # compiler. Scoped to version 14.2.0-19 (all three packages share it) so
  # a different gcc-14 build is re-scanned; not scoped by name because
  # grype reads a package name as a regular expression and `libstdc++6`
  # never matched. Drop at the first trixie gcc-14 update that fixes it.
  # Renewed 2026-10-18: packages.debian.org still lists trixie gcc-14 at
  # 14.2.0-19, so there is no newer build to pin, and the scan still matches
  # only that version (the Debian tracker did not answer that day). Same
  # horizon as CVE-2026-102010 above. expiresAt: 2026-11-15
  - vulnerability: CVE-2026-95619
    package:
      version: 14.2.0-19
      type: deb

  # ── Debian trixie base packages, misc (7 CVEs) ─────────────────────────
  # owner: platform — reason: won't-fix by Debian triage; the binaries/libs
  # are unused by the app runtime (no gzip/ncurses/libacl/sqlite/pcre2 calls
  # from node — Node bundles its own zlib, has no sqlite, and links no PCRE).
  # libpcre2 was FIXABLE on bookworm (10.42-1+deb12u1 was pinned there); on
  # trixie 10.46-1~deb13u1 Debian marks CVE-2026-86145 won't-fix and no newer
  # package exists. expiresAt: 2026-12-07
  - vulnerability: CVE-2026-41992 # gzip 1.13-1, wont-fix
  - vulnerability: CVE-2025-69720 # ncurses 6.5+20250216-2, wont-fix
  - vulnerability: CVE-2026-54369 # libacl1 2.3.2-2+b1, wont-fix
  - vulnerability: CVE-2026-54370 # libacl1 2.3.2-2+b1, wont-fix
  - vulnerability: CVE-2026-11822 # libsqlite3-0 3.46.1-7+deb13u1, wont-fix (new in the trixie scan)
  - vulnerability: CVE-2026-11824 # libsqlite3-0 3.46.1-7+deb13u1, wont-fix (new in the trixie scan)
  - vulnerability: CVE-2026-86145 # libpcre2-8-0 10.46-1~deb13u1, wont-fix on trixie

  # ── libsqlite3-0 3.46.1-7+deb13u2: no trixie fix (3 CVEs) ─────────────
  # owner: platform — reason: first reported by the grype DB of 2026-11-03 on
  # PR #1069's scan: `libsqlite3-0 3.46.1-7+deb13u2 deb CVE-2026-119373 /
  # -119374 / -119379 High`, heap overflows reached through a crafted FTS5
  # index or session changeset. The Debian tracker (read 2026-11-03) lists
  # trixie vulnerable and `<no-dsa> (Minor issue)`; the fix is only in sid
  # (3.54.1-1), so there is nothing to pin. As in the section above, node has no
  # call into the system SQLite, and the application's database is PostgreSQL.
  # Drop these at the first trixie sqlite3 update that fixes them.
  # expiresAt: 2026-12-03
  - vulnerability: CVE-2026-119373 # FTS5 fts5MergeRowidLists
  - vulnerability: CVE-2026-119374 # FTS5 fts5DoSecureDelete
  - vulnerability: CVE-2026-119379 # session extension sessionUpdateFind

  # ── Go stdlib inside esbuild CLI binaries (prod node_modules) ─────────
  # owner: platform — reason: the esbuild@0.18.20 (go1.20.7) and
  # esbuild@0.25.12 (go1.23.12) binaries sit in prod node_modules only
  # because better-auth declares drizzle-kit as a runtime dependency. Nothing
  # executes esbuild in the image: the CMD is `node` on pre-built bundles and
  # migrations run the bundled dist-worker/migrate-deploy.js (drizzle-orm
  # migrator, not the drizzle-kit CLI). The findings are in an unreachable
  # binary. Fix-forward: better-auth dropping the drizzle-kit runtime dep
  # (tracked at the quarterly review). expiresAt: 2026-12-07
  - package:
      name: stdlib
      version: go1.20.7
      type: go-module
  - package:
      name: stdlib
      version: go1.23.12
      type: go-module

  # ── Debian trixie base packages, util-linux 2.41.5-0+deb13u1 and zlib1g
  #    1:1.3.dfsg+really1.3.1-1+b1 (5 CVEs) ───────────────────────────────
  # owner: platform — reason: won't-fix on trixie as on bookworm (util-linux
  # is fixed only in unstable; zlib is unfixed upstream). The reachable
  # surface was removed rather than excepted:
  #   - the four util-linux CVEs are local escalation through setuid mount
  #     helpers; every production runtime stage drops every setuid/setgid
  #     bit (`RUN find / -xdev -perm /6000 -type f -exec chmod ug-s {} +`),
  #     and the processes run as a non-root user with no CAP_SYS_ADMIN;
  #   - the zlib CVE is in the system libz `gz_vacate()` path; the runtime
  #     `node` binary is built with `shared_zlib: false` and does not link
  #     libz at all, so the application cannot reach it.
  # expiresAt: 2026-12-07
  - vulnerability: CVE-2026-76642 # util-linux, no trixie fix
  - vulnerability: CVE-2026-78408 # util-linux, no trixie fix
  - vulnerability: CVE-2026-78409 # util-linux, no trixie fix
  - vulnerability: CVE-2026-78410 # util-linux, no trixie fix
  - vulnerability: CVE-2026-85091 # zlib1g, unfixed upstream