# List any vulnerability that are to be accepted
# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/
# for more details
# e.g.
# CVE-2022-3996

# CVE-2026-1615: HIGH - jsonpath 1.2.1 - Arbitrary Code Execution via unsafe JSON path evaluation
# No fix confirmed in 1.3.0 (latest). Tracked in UID2-6610.
CVE-2026-1615 exp:2026-09-16

# zlib contrib/untgz demo utility buffer overflow - not exploitable; Alpine does not ship the untgz binary.
# See: UID2-6704
CVE-2026-22184 exp:2026-09-09

# GHSA-2p49-hgcm-8545 (HIGH) - svgo removeScripts plugin leaves some executable scripts intact.
# svgo is build-time-only tooling here: it optimizes the examples' own (trusted) SVG assets at
# build time and is never run against untrusted input, so it is not reachable at runtime. The
# app-level svgo (3.x) and postcss-svgo (2.x) could be bumped, but a third copy is svgo 1.3.2
# bundled inside react-scripts@5's @svgr/webpack@5.5.0, which has NO in-major fix (fixed only in
# 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until
# react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698)
GHSA-2p49-hgcm-8545 exp:2026-08-23

# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH).
# Not exploitable here: react-client-side resolves fast-uri 3.1.4 (prod, via ajv build
# tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct
# fast-uri import; sample-app build/dev tooling
# See: UID2-7633
CVE-2026-18446 exp:2026-11-06

# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH).
# Not exploitable here: web-integrations/server-side/package-lock.json:600 brace-
# expansion@5.0.8 via minimatch@10.2.4 (dev/build tooling); server.js requires only
# axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request
# path
# See: UID2-7619
CVE-2026-69152 exp:2026-11-06