chore(security): .trivyignore entries have expired

Open

#222 opened on Jul 20, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 42/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Domain: devops, security

Research direction

Start with .trivyignore and .github/workflows/trivyignore-expiration.yml to understand the expired entries and how they are generated. Check upstream fixes for each listed CVE, then either remove entries after updating the affected image or dependency, or extend each still-needed expiry with a fresh rationale. Done means all five entries have been reassessed and .trivyignore no longer contains expired, unjustified dates.

Written by the indexing model from the issue text.

Description

The following .trivyignore entries have passed their exp:YYYY-MM-DD date and need to be reassessed.

CVE-2026-28390 — expired on 2026-06-10
CVE-2026-28387 — expired on 2026-06-10
CVE-2026-28388 — expired on 2026-06-10
CVE-2026-28389 — expired on 2026-06-10
CVE-2026-31789 — expired on 2026-06-10

For each entry:

Re-check upstream for a fix (new base image, new dependency release).
If fixed: bump the affected image/dependency and remove the line from .trivyignore.
If still unfixed and still not exploitable in our context: extend the exp: date with a fresh rationale.

Generated by .github/workflows/trivyignore-expiration.yml.

Dominant language: Go
Stars: 2
Forks: 0
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

GrafeasNote is a duplicate resource of ContainerAnalysisNote Open

Difficulty 1/5 Under an hour Newbie friendliness 84/100

GoogleCloudPlatform/k8s-config-connector#13349 · Opened Sep 21, 2026
[receiver/receiverhelper] skip WithLinks when the parent span context is invalid Open

enhancement needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

open-telemetry/opentelemetry-collector#15998 · Opened Sep 21, 2026
🧹 Use PodSet wrappers in DRA tests Open

kind/cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

kubernetes-sigs/kueue#15947 · Opened Sep 21, 2026
Custom provider credential is written as `PROVIDER_API_KEY` (apiserver) but the AgentRun controller injects only allowlisted keys, so every custom provider fails with HTTP 401 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

sympozium-ai/sympozium#627 · Opened Sep 21, 2026
A recording that opens with an all-zero last_throw emits a zeroed discThrown at frame 0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EchoTools/tape#60 · Opened Sep 21, 2026

More Go issues