Accept ImageSharp findings pulled in by Scryber.Core in Trivy scans

[KrzysztofPajak]

Type: feature

Issue

The Trivy workflow (#927) reports three HIGH findings in SixLabors.ImageSharp 3.1.12: CVE-2026-106110, CVE-2026-106113 and CVE-2026-106115, fixed in 4.1.2. ImageSharp is not referenced by GrandNode. It comes in transitively through Scryber.Core (PDF generation), which pins 3.1.12, including in its latest release 9.7.5. There is no compatible fix to update to: forcing 4.x, a major version with API changes, under a library built against 3.x risks runtime failures in PDF generation.

Solution

New .trivyignore at the repository root (Trivy reads it by default, so the workflow is unchanged), with the three CVEs and the reasoning:

• The vulnerable code is the TIFF CCITT T4/T6 encoders and HistogramEqualization.
• GrandNode code has no reference to ImageSharp.
• Scryber.Imaging only uses TiffFormat, TiffMetadata and DecoderOptions (format detection and decoding). It has no encoder and no histogram processing (checked in the 9.7.4.4 assemblies).

Each entry has exp:2027-01-16. After that date Trivy reports the findings again, so the decision has to be reviewed. Drop the entries once Scryber.Core moves to ImageSharp 4.1.2 or later.

The ignore file applies to the SARIF output too, so these findings will not show up in Code scanning while the entries are valid.

Breaking changes

None.

Testing

1. With this .trivyignore and the System.Security.Cryptography.Xml bump from Update System.Security.Cryptography.Xml to 10.0.13 #928, run locally with Trivy 0.70.0: trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --ignorefile .trivyignore . on a tree with built projects (bin/**/*.deps.json). Exit code 0.
2. Without the file, the same run reports the three ImageSharp CVEs from Grand.Business.Common.deps.json.
3. Once merged together with Add Trivy security scan workflow and README badge #927 and Update System.Security.Cryptography.Xml to 10.0.13 #928, the Trivy workflow on develop should pass, unless the image job finds something in the base image OS packages.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.