chore(security): .trivyignore entries have expired

Open

#228 opened on Aug 31, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 45/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Domain: devops, security

Research direction

Start with the .trivyignore entries listed in the issue and inspect .github/workflows/trivyignore-expiration.yml to understand how expiration is checked. Re-check upstream advisories and the affected base images or dependencies; done means each CVE is either removed after a fix and upgrade or has a fresh expiry date and rationale, with the Trivy expiration workflow passing.

Written by the indexing model from the issue text.

Description

The following .trivyignore entries have passed their exp:YYYY-MM-DD date and need to be reassessed.

CVE-2026-28390 — expired on 2026-06-10
CVE-2026-28387 — expired on 2026-06-10
CVE-2026-28388 — expired on 2026-06-10
CVE-2026-28389 — expired on 2026-06-10
CVE-2026-31789 — expired on 2026-06-10
CVE-2026-29181 — expired on 2026-08-10
CVE-2026-32280 — expired on 2026-08-10
CVE-2026-32281 — expired on 2026-08-10
CVE-2026-32283 — expired on 2026-08-10
CVE-2026-33811 — expired on 2026-08-10
CVE-2026-33814 — expired on 2026-08-10
CVE-2026-39820 — expired on 2026-08-10
CVE-2026-39836 — expired on 2026-08-10
CVE-2026-42499 — expired on 2026-08-10
CVE-2026-46680 — expired on 2026-08-10

For each entry:

Re-check upstream for a fix (new base image, new dependency release).
If fixed: bump the affected image/dependency and remove the line from .trivyignore.
If still unfixed and still not exploitable in our context: extend the exp: date with a fresh rationale.

Generated by .github/workflows/trivyignore-expiration.yml.

Dominant language: Go
Stars: 2
Forks: 0
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

GrafeasNote is a duplicate resource of ContainerAnalysisNote Open

Difficulty 1/5 Under an hour Newbie friendliness 84/100

GoogleCloudPlatform/k8s-config-connector#13349 · Opened Sep 21, 2026
[receiver/receiverhelper] skip WithLinks when the parent span context is invalid Open

enhancement needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

open-telemetry/opentelemetry-collector#15998 · Opened Sep 21, 2026
🧹 Use PodSet wrappers in DRA tests Open

kind/cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

kubernetes-sigs/kueue#15947 · Opened Sep 21, 2026
Custom provider credential is written as `PROVIDER_API_KEY` (apiserver) but the AgentRun controller injects only allowlisted keys, so every custom provider fails with HTTP 401 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

sympozium-ai/sympozium#627 · Opened Sep 21, 2026
A recording that opens with an all-zero last_throw emits a zeroed discThrown at frame 0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EchoTools/tape#60 · Opened Sep 21, 2026

More Go issues