From e0ca90c078489cf3e80e0bc31f410b1002051b35 Mon Sep 17 00:00:00 2001 From: support Date: Fri, 16 Oct 2026 07:39:03 +0200 Subject: [PATCH] Accept ImageSharp findings pulled in by Scryber.Core in Trivy scans Scryber.Core pins SixLabors.ImageSharp 3.1.12 up to its latest release, and the fix only exists in 4.1.2. The affected TIFF CCITT encoders and HistogramEqualization are not reachable from GrandNode or Scryber, so the three CVEs are ignored until 2027-01-16. --- .trivyignore | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000..b96220ddd --- /dev/null +++ b/.trivyignore @@ -0,0 +1,12 @@ +# Findings accepted after review. Each entry expires and is reported again +# on that date, so it has to be reviewed rather than forgotten. + +# SixLabors.ImageSharp 3.1.12 (fixed in 4.1.2), a transitive dependency of +# Scryber.Core, which pins 3.1.12 up to its latest release (9.7.5). +# GrandNode does not reference ImageSharp; Scryber.Imaging only detects and +# decodes images (TiffFormat, TiffMetadata, DecoderOptions). The affected code +# is never called: the TIFF CCITT T4/T6 encoders and HistogramEqualization. +# Drop these entries once Scryber.Core moves to ImageSharp 4.1.2 or later. +CVE-2026-106110 exp:2027-01-16 +CVE-2026-106113 exp:2027-01-16 +CVE-2026-106115 exp:2027-01-16