b156821585
Some checks failed
Infra CI / api (push) Has been cancelled
Infra CI / notebooks (push) Has been cancelled
CI / lint-test (push) Has been cancelled
CI / skinny-install (aco) (push) Has been cancelled
CI / skinny-install (api) (push) Has been cancelled
CI / skinny-install (bcda) (push) Has been cancelled
CI / skinny-install (bib) (push) Has been cancelled
CI / skinny-install (bls) (push) Has been cancelled
CI / skinny-install (ccw) (push) Has been cancelled
CI / skinny-install (cli) (push) Has been cancelled
CI / skinny-install (cms) (push) Has been cancelled
CI / skinny-install (conf) (push) Has been cancelled
CI / skinny-install (opps) (push) Has been cancelled
CI / skinny-install (perf) (push) Has been cancelled
CI / skinny-install (pfs) (push) Has been cancelled
CI / skinny-install (rex) (push) Has been cancelled
Deploy / build-scan-report (push) Has been cancelled
Infra CI / zotero (push) Has been cancelled
Infra CI / docs (push) Has been cancelled
Infra CI / mc (push) Has been cancelled
Remove 3 unnecessary binaries with Go stdlib CVEs from zotero image: - /usr/sbin/ipp-usb (IPP printer daemon — not needed) - /usr/bin/yq (YAML processor — not needed at runtime) - firefox (base image browser — Zotero ships its own) Eliminates 21 HIGH/CRITICAL Go stdlib CVEs (CVE-2024-24790 through CVE-2026-32282). Down from 31 to 10 findings, all 10 are unfixed upstream Ubuntu packages (gstreamer, Qt WebEngine) with no patch. Add .trivyignore for the 2 unfixable upstream CVEs so the scan passes clean. Point deploy.yml trivy scans at .trivyignore.
5 lines
246 B
Plaintext
5 lines
246 B
Plaintext
# Unfixed upstream CVEs — no patch available in Ubuntu 24.04 repos.
|
|
# Reviewed 2026-04-18. Remove entries as fixes land.
|
|
CVE-2025-3887 # gstreamer plugins-bad — no fix available
|
|
CVE-2025-9900 # Qt WebEngine / libtiff — no fix available
|