[ik-code-writer]

Add temporary Trivy ignore entries for newly reported CVEs.

Jira issue(s): not linked
Workflow run: https://github.com/indykite/developer-hub/actions/runs/42630329542

The entries reference confirmed Jira issues or the workflow run and should be removed after remediation or formal risk acceptance.

[Copilot]

🟡 Changes recommended

Switching to .trivyignore.yaml drops three existing suppressions because Trivy does not merge ignore files, allowing previously ignored findings to fail scans again.

1 open issue

• Preserve existing suppressions when switching to the YAML ignore file · New

What changed in this PR

Adds six Trivy vulnerability suppressions pending remediation and configures scans to use the YAML ignore file.

Changes:

• Records six CVE ignore entries with workflow-run references and generation timestamps.
• Enables .trivyignore.yaml in the Trivy configuration.

File	Description
.trivyignore.yaml	Adds six CVE suppressions with traceability statements.
.trivy.yaml	Selects the YAML ignore file and removes extra blank lines.

_{Review effort: Balanced}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 13d64df...1f30456 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Nov 10, 2026 7:46p.m.	Review ↗
Python		Nov 10, 2026 7:46p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

🟡 Changes recommended

The new Trivy ignore file omits three existing suppressions, and because it replaces rather than merges with the default file, previously suppressed findings can fail scans again.

2 open issues

• Preserve existing suppressions when switching Trivy ignore files · New
• Preserve existing suppressions when switching to the YAML ignore file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Switching to .trivyignore.yaml drops the existing suppressions for CVE-2025-8869, CVE-2026-3219, and KSV-0125, allowing previously exempted findings to fail scans unless those entries are preserved.

3 open issues

• Preserve existing exceptions when switching the Trivy ignore file · New
• Preserve existing suppressions when switching Trivy ignore files
• Preserve existing suppressions when switching to the YAML ignore file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Switching Trivy to .trivyignore.yaml drops the existing vulnerability and misconfiguration suppressions, which must be migrated to prevent scans from failing on intentionally excluded findings.

4 open issues

• Preserve existing exceptions when switching the Trivy ignore file
• Preserve existing Trivy exclusions when setting ignorefile · New
• Preserve existing suppressions when switching Trivy ignore files
• Preserve existing suppressions when switching to the YAML ignore file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The six new CVE suppressions lack affected-package, severity, and remediation details, requiring security-owner review to validate the accepted risk and intended exception duration.

No open issues 🎉

4 resolved since last review

• Preserve existing exceptions when switching the Trivy ignore file
• Preserve existing Trivy exclusions when setting ignorefile
• Preserve existing suppressions when switching Trivy ignore files
• Preserve existing suppressions when switching to the YAML ignore file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The six repository-wide CVE suppressions lack supporting scan findings and remediation or risk-acceptance evidence in the snapshot, requiring security-owner validation of their scope and justification.

No open issues 🎉

_{Review effort: Balanced}