From 3ddc15a0818eb14d437b30be4d1d239d4972dc54 Mon Sep 17 00:00:00 2001
From: yuneng-jiang <yuneng.jiang@gmail.com>
Date: Thu, 22 Jan 2026 11:26:04 -0800
Subject: [PATCH] Adding lodash-es to allowlist

---
 ci_cd/security_scans.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci_cd/security_scans.sh b/ci_cd/security_scans.sh
index 04f3e27a944..9c7ae4ed7c1 100755
--- a/ci_cd/security_scans.sh
+++ b/ci_cd/security_scans.sh
@@ -138,6 +138,7 @@ run_grype_scans() {
         "CVE-2026-22184" # zlib untgz buffer overflow - untgz unused + no fixed Wolfi build yet
         "GHSA-58pv-8j8x-9vj2" # jaraco.context path traversal - setuptools vendored only (v5.3.0), not used in application code (using v6.1.0+)
         "GHSA-r6q2-hw4h-h46w" # node-tar not used by application runtime, Linux-only container, not affect by macOS APFS-specific exploit
+        "CVE-2025-13465" # lodash-es is found in the docs dependencies, not used in application code
     )
 
     # Build JSON array of allowlisted CVE IDs for jq