# MC 107028 — Trivy Dependency Gate Hotfix Closure

# MC #107028 — Trivy Dependency Gate Hotfix Closure

## Outcome

Azure PR **333** completed successfully. Exact reviewed source commit `7a384384f9f6a1a9a7e304a44ad4482f9c23f53c` merged to canonical `main` as `ae18e9508737d285f80103f0b5a2e040670a7c6e` after Azure build **1012** and its blocking policy passed.

## Security change

- Updated all resolved `nanoid@3.3.16` lock entries to patched `3.3.18` across the root npm lock and BA/HR/IO pnpm locks.
- Added a temporary waiver for exactly `CVE-2025-71329` and `CVE-2025-71330` in `image-size@1.2.1`, transitive through Metro mobile build tooling.
- Waiver expiry: **2026-09-09**. It must be removed when an upstream patched release exists; review upstream weekly until then.
- No wildcard suppression, `--ignore-unfixed`, pipeline weakening, production-code change, or deployment was part of this hotfix.

## Verification

- Trivy 0.72 exact-commit scan: zero unwaived HIGH/CRITICAL findings across all four lockfiles.
- Negative control: removing only the two waiver IDs returns exit 1 and exactly those two `image-size` CVEs.
- Root npm and three pnpm frozen installs pass without lock drift.
- Gitleaks exact commit: one commit scanned, no leaks.
- Independent Redžo review: PASS, P0=0, P1=0, waiver explicitly approved.

## Operations and rollback

If `image-size` ships a fixed compatible release, update Metro/mobile locks, remove both waiver IDs, run the unchanged Trivy gate and frozen-install checks, then submit a separate reviewed PR. If a new runtime or untrusted-input exposure is discovered before expiry, revoke the waiver and block builds immediately.

## Durable evidence

- `/Users/makinja/system/evidence/107028/pr-333-completed.json`
- `/Users/makinja/system/evidence/107028/build-1012.json`
- `/Users/makinja/system/evidence/107028/independent-security-review.json`
- `/Users/makinja/system/evidence/107028/trivy-commit-7a384384.txt`
- `/Users/makinja/system/evidence/107028/trivy-negative-without-image-size-waiver-2026-08-09.json`
- `/Users/makinja/system/evidence/107028/gitleaks-commit-7a384384.txt`