Skip to main content

MC 107028 — Trivy Dependency Gate Hotfix Closure

MC #107028 — Trivy Dependency Gate Hotfix Closure

Outcome

Azure PR 333 completed successfully. Exact reviewed source commit 7a384384f9f6a1a9a7e304a44ad4482f9c23f53c merged to canonical main as ae18e9508737d285f80103f0b5a2e040670a7c6e after Azure build 1012 and its blocking policy passed.

Security change

  • Updated all resolved [email protected] lock entries to patched 3.3.18 across the root npm lock and BA/HR/IO pnpm locks.
  • Added a temporary waiver for exactly CVE-2025-71329 and CVE-2025-71330 in [email protected], transitive through Metro mobile build tooling.
  • Waiver expiry: 2026-09-09. It must be removed when an upstream patched release exists; review upstream weekly until then.
  • No wildcard suppression, --ignore-unfixed, pipeline weakening, production-code change, or deployment was part of this hotfix.

Verification

  • Trivy 0.72 exact-commit scan: zero unwaived HIGH/CRITICAL findings across all four lockfiles.
  • Negative control: removing only the two waiver IDs returns exit 1 and exactly those two image-size CVEs.
  • Root npm and three pnpm frozen installs pass without lock drift.
  • Gitleaks exact commit: one commit scanned, no leaks.
  • Independent Redžo review: PASS, P0=0, P1=0, waiver explicitly approved.

Operations and rollback

If image-size ships a fixed compatible release, update Metro/mobile locks, remove both waiver IDs, run the unchanged Trivy gate and frozen-install checks, then submit a separate reviewed PR. If a new runtime or untrusted-input exposure is discovered before expiry, revoke the waiver and block builds immediately.

Durable evidence

  • /Users/makinja/system/evidence/107028/pr-333-completed.json
  • /Users/makinja/system/evidence/107028/build-1012.json
  • /Users/makinja/system/evidence/107028/independent-security-review.json
  • /Users/makinja/system/evidence/107028/trivy-commit-7a384384.txt
  • /Users/makinja/system/evidence/107028/trivy-negative-without-image-size-waiver-2026-08-09.json
  • /Users/makinja/system/evidence/107028/gitleaks-commit-7a384384.txt

No comments to display

Back to top