# .trivyignore — accepted-risk suppressions for the container image scan
#
# Policy (see docs/security/SUPPLY_CHAIN.md):
#   - The Trivy steps in .github/workflows/docker-publish.yml run with
#     `ignore-unfixed: true`, so vulnerabilities WITHOUT a published fix are
#     already excluded from both the blocking CRITICAL gate and the advisory
#     Security-tab upload. You do NOT need an entry here for an unfixable
#     base-image OS CVE — it will not be reported.
#   - This file is the single auditable home for the rare case where a *fixable*
#     CVE must be temporarily accepted (e.g. the upstream fix is not yet in the
#     pinned base tag, or the affected package/binary is provably unreachable
#     from the proxy request surface and rebuilding now is not justified).
#
# Format — one CVE id per line, each with a justification comment and, where
# possible, an expiry, e.g.:
#   # CVE-XXXX-YYYY — <why accepted>; revisit on next base-image bump (YYYY-MM-DD)
#   CVE-XXXX-YYYY
#
# Keep this list SHORT and reviewed every release. Prefer fixing (rebuild on a
# patched base / bump the dep) over suppressing. Stale entries are debt.
#
# CVE-2025-68121 — Go stdlib crypto/tls (session-resumption certificate validation)
#   inside the PREBUILT bogdanfinn/tls-client v1.15.1 .so that tls-client-node's
#   postinstall downloads (built with go 1.24.1; fixed in 1.24.13). No upstream
#   rebuild exists (v1.15.1 is still the latest release) and nothing in this repo
#   can bump it. The binary is only loaded by the browser-TLS web-provider
#   executors (claude-web / grok-web / lmarena / perplexity-web / notion-web),
#   whose handshakes go through utls. Tracking issue: #12084. Revisit at the next
#   tls-client release or base-image bump and BEFORE the v3.8.51 tag (2026-09-15).
CVE-2025-68121
