From 976e9df3b65751e32cfc1bc6cce59d1315ee1684 Mon Sep 17 00:00:00 2001
From: Patrick Buckley <eous@users.noreply.github.com>
Date: Sun, 29 Mar 2026 15:35:20 -0700
Subject: [PATCH] ci: suppress CVE-2026-25210 (libexpat1, no fix available)
 (#230)

Integer overflow in libexpat1 2.7.1-2 with no patched version in
Debian repos yet.  Suppress in Trivy until a fix is published.
---
 .trivyignore | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .trivyignore

diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 00000000..98b52072
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,4 @@
+# libexpat integer overflow — no fix available in Debian repos yet
+# https://avd.aquasec.com/nvd/cve-2026-25210
+# Review: remove this entry once a patched libexpat1 is published
+CVE-2026-25210