[frankiehot-tech]

背景

main 的 Security Scan 因 trivy DB 新收录的 2 条 CRITICAL CVE 失败，D1 Pre-Flight G3 因此阻塞 v0.55.1 tag 推送。

本 PR 仅按 .trivyignore 既有纪律补充忽略条目（每条附理由与失效条件），不改变运行时依赖。

条目

• CVE-2026-115905 / CVE-2026-115909: Rust zip 4.6.1，仅 gui/src-tauri 桌面依赖，不进入 PyPI/Docker 运行时；修复需跨大版本（9.0.5），另立升级议题。
• CVE-2026-111497: 与已忽略的 GHSA-9v8h-qqgm-4m35 为同一 brotli 缺陷，trivy 以 CVE 编号重复报告；镜像构建已强制 brotli>=1.2.1。

验证

• main Security Scan 重跑应转绿
• D1 Pre-Flight G3 恢复通过后再推 v0.55.1 tag

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud