MC 107028 — Trivy Dependency Gate Hotfix Closure
MC #107028 — Trivy Dependency Gate Hotfix Closure
Outcome
Azure PR 333 completed successfully. Exact reviewed source commit 7a384384f9f6a1a9a7e304a44ad4482f9c23f53c merged to canonical main as ae18e9508737d285f80103f0b5a2e040670a7c6e after Azure build 1012 and its blocking policy passed.
Security change
- Updated all resolved
nanoid@3.3.16lock entries to patched3.3.18across the root npm lock and BA/HR/IO pnpm locks. - Added a temporary waiver for exactly
CVE-2025-71329andCVE-2025-71330inimage-size@1.2.1, transitive through Metro mobile build tooling. - Waiver expiry: 2026-09-09. It must be removed when an upstream patched release exists; review upstream weekly until then.
- No wildcard suppression,
--ignore-unfixed, pipeline weakening, production-code change, or deployment was part of this hotfix.
Verification
- Trivy 0.72 exact-commit scan: zero unwaived HIGH/CRITICAL findings across all four lockfiles.
- Negative control: removing only the two waiver IDs returns exit 1 and exactly those two
image-sizeCVEs. - Root npm and three pnpm frozen installs pass without lock drift.
- Gitleaks exact commit: one commit scanned, no leaks.
- Independent Redžo review: PASS, P0=0, P1=0, waiver explicitly approved.
Operations and rollback
If image-size ships a fixed compatible release, update Metro/mobile locks, remove both waiver IDs, run the unchanged Trivy gate and frozen-install checks, then submit a separate reviewed PR. If a new runtime or untrusted-input exposure is discovered before expiry, revoke the waiver and block builds immediately.
Durable evidence
/Users/makinja/system/evidence/107028/pr-333-completed.json/Users/makinja/system/evidence/107028/build-1012.json/Users/makinja/system/evidence/107028/independent-security-review.json/Users/makinja/system/evidence/107028/trivy-commit-7a384384.txt/Users/makinja/system/evidence/107028/trivy-negative-without-image-size-waiver-2026-08-09.json/Users/makinja/system/evidence/107028/gitleaks-commit-7a384384.txt