engraphis/.grype.yaml at main · Coding-Dev-Tools/engraphis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# Grype vulnerability scanner configuration.
# See: https://github.com/anchore/grype#configuration
#
# The production image uses python:3.11-slim (Debian trixie) with gosu for
# privilege dropping. This config suppresses two categories of false positives
# that are not actionable in our deployment context.

ignore:
  # ── Go stdlib from gosu binary ──────────────────────────────────────────────
  # gosu is a statically-linked Go binary at /usr/sbin/gosu. Syft extracts the
  # Go stdlib version (go1.24.4) from its embedded buildinfo, and grype matches
  # all Go CVEs against it. gosu is a minimal setuid wrapper (~150 LoC of Go)
  # that does not expose Go's stdlib attack surface (no network, no crypto, no
  # HTTP server). These are false positives.
  - package:
      name: "stdlib"
      type: "go-module"

  # ── Python 3.11 CVEs with fixes only in 3.13+ ──────────────────────────────
  # Python 3.11 is in security-fix-only mode (PEP 664). These CVEs have fixes
  # only in Python 3.13+ and will not be backported. Our Dockerfile pins
  # python:3.11-slim which tracks 3.11.x security releases. These are not
  # actionable without upgrading to Python 3.13+.
  - vulnerability: "CVE-2026-7210"     # fix: 3.13.14+
  - vulnerability: "CVE-2026-11940"    # fix: 3.13.15+
  - vulnerability: "CVE-2026-15308"    # fix: 3.15.0+
  - vulnerability: "CVE-2026-6100"     # fix: 3.13.14+
  - vulnerability: "CVE-2026-4224"     # fix: 3.13.13+
  - vulnerability: "CVE-2026-11972"    # fix: 3.13.15+
  - vulnerability: "CVE-2026-3644"     # fix: 3.13.13+
  - vulnerability: "CVE-2026-9669"     # fix: 3.13.14+
  - vulnerability: "CVE-2026-3298"     # fix: 3.13.14+
  - vulnerability: "CVE-2026-4786"     # fix: 3.13.14+
  - vulnerability: "CVE-2026-82049"    # fix: 3.14.0b1+