# Wolfi's security database names zlib 1.3.3-r0 as the fix for CVE-2026-85091,
# but the newest zlib published to the Wolfi apk repo is 1.3.2-r7, so every
# wolfi-base digest reports it and no `apk upgrade` can clear it.
# Drop this once Wolfi ships zlib >= 1.3.3-r0; expected by 2026-10-15.
ignore:
  - vulnerability: CVE-2026-85091
    package:
      name: zlib
      type: apk
  - vulnerability: GHSA-g5fp-32jq-cfw2
    package:
      name: zlib
      type: apk
  - vulnerability: GHSA-v4x8-3wr5-3wq8
    reason: >-
      filelock ReadWriteLock advisory, and no package in the image takes ReadWriteLock;
      the fix (4.2.1) is blocked by litellm's own filelock<4.0 cap until #48635 or #48802 lifts it,
      and the image then moves off 3.32.7, which retires this version-scoped rule
    package:
      name: filelock
      version: 3.32.7
      type: python