From 9834749fd7111b07746cc99c7c3d47db02eff428 Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 10 Sep 2026 01:34:31 +0000 Subject: [PATCH] Suppress js-yaml and svgo CVEs, not reachable at runtime UID2-7851 Co-Authored-By: Claude Sonnet 5 --- .trivyignore | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.trivyignore b/.trivyignore index aa1bd627e..1bf712124 100644 --- a/.trivyignore +++ b/.trivyignore @@ -91,3 +91,11 @@ CVE-2026-75975 exp:2026-12-03 # in source; ajv runs at build time parsing JSON Schema URIs. # See: UID2-7815 CVE-2026-76172 exp:2026-12-03 + +# js-yaml is a build-time-only transitive dependency (Docusaurus/gray-matter/eslint); this is a static site with no runtime YAML parsing +# See: UID2-7851 +CVE-2026-84375 exp:2026-10-10 + +# svgo runs only at build time optimizing repo-owned static SVGs; no user-upload/sanitization path exists in this static docs site +# See: UID2-7852 +CVE-2026-84370 exp:2026-10-10