update trivyignore

Author: ADOT Patch workflow

.github/trivy/daily-scan.trivyignore.yaml

@@ -10,22 +10,25 @@
 #   expired_at: <required - YYYY-MM-DD>
 
 vulnerabilities:
-  # AWS SDK v1 (com.amazonaws:aws-java-sdk-core:1.12.788) embeds jackson-core 2.12.7
-  # in its published POM. AWS SDK v1 reached EOL on 2025-12-31 and will not receive
-  # jackson updates. The X-Ray SDK's own jackson BOM (2.18.6) ensures the actual
-  # jackson JAR on the classpath is patched — these findings are from the third-party
-  # POM metadata only, not from the actual JARs resolved at runtime.
+  # The AWS SDK for Java v1 (com.amazonaws:aws-java-sdk-core:1.12.788) reached EOL
+  # on 2025-12-31 and will not receive further releases. Its published JARs embed POM
+  # metadata declaring jackson-core 2.12.7 as a dependency — this cannot be changed.
+  # The X-Ray SDK still supports AWS SDK v1 instrumentation via the
+  # aws-xray-recorder-sdk-aws-sdk module, but the actual jackson-core JAR resolved
+  # at runtime is 2.18.6 (provided by the X-Ray SDK's own jackson BOM). Maven
+  # dependency mediation ensures the higher version wins. These Trivy findings are
+  # from third-party POM metadata only, not the actual runtime JARs.
   - id: CVE-2025-52999
     paths:
       - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml"
       - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml"
       - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml"
-    statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM."
+    statement: "AWS SDK v1 EOL (1.12.788 is final release) — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM."
     expired_at: 2027-03-25
   - id: GHSA-72hv-8253-57qq
     paths:
       - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml"
       - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml"
       - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml"
-    statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM."
+    statement: "AWS SDK v1 EOL (1.12.788 is final release) — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM."
     expired_at: 2027-03-25