From 36895001ab00cdc1fbde2fe90b9d6f125601e60f Mon Sep 17 00:00:00 2001
From: sean wibisono <sean.wibisono@thetradedesk.com>
Date: Thu, 6 Aug 2026 15:20:14 +1000
Subject: [PATCH] UID2-7619: suppress CVE-2026-69152 in .trivyignore (exp
 2026-09-06)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

unknown package is present but not reachable from this service — see UID2-7619 for the impact assessment. Reachability alone determines suppress-vs-fix.
---
 .trivyignore | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.trivyignore b/.trivyignore
index 3aa85f54a..26acc1c2b 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -3,3 +3,9 @@
 # for more details
 # e.g. 
 # CVE-2022-3996
+
+# CVE-2026-69152 — brace-expansion (npm) (HIGH).
+# Not exploitable here: package.json overrides brace-expansion@5=5.0.8; docusaurus static-site
+# generator. Build-time-only glob/minimatch dependency; no runtime pattern expansion.
+# See: UID2-7619
+CVE-2026-69152 exp:2026-09-06